[Desktop][Browser] Allowed website remains blocked by a saved permission preference

Open
#37,885 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
rust
Domain
desktop, security

Research direction

Reproduce the issue in the Windows desktop app using the built-in Browser, starting with Settings → Browser → Website permissions for https://play.google.com. Compare the saved View permission with the Browser Use permission state across a fresh session and app restart. Done means an allowed View permission permits inspection, or an absent valid permission triggers a new request instead of applying a stale denial.

Written by the indexing model from the issue text.

Description

app browser bug windows-os
Summary

In the Windows desktop app, the built-in Browser shows https://play.google.com as allowed, but Browser Use consistently rejects read access because it sees a saved blocking preference.

The permissions UI and the Browser Use permission state appear to be out of sync.

Steps to reproduce
  1. Open and sign in to Google Play Console in the built-in browser.
  2. Open Settings → Browser → Website permissions.
  3. Set View, Download, and Upload to Allow for https://play.google.com, then save the settings.
  4. Ask Codex to inspect the open Play Console tab.
  5. Restart the desktop app and repeat the test with a fresh browser session.
Actual result

Every attempt to read the page is rejected immediately with this message:

Browser Use rejected this action due to browser security policy.
Reason: A saved user permission setting blocks this action.
Browser use cannot access https://play.google.com because the user has a saved preference that blocks it.

No new permission prompt appears.

The result is the same after:

  • saving the site permission again;
  • removing and recreating the permission;
  • fully restarting the desktop app;
  • opening a fresh built-in browser session;
  • testing both the Play Console application list and an application dashboard.
Expected result

When View is set to Allow, Codex should be able to inspect the page. If no valid permission is stored, the desktop app should show a new permission request instead of silently applying a stale denial.

Impact

Authenticated browser workflows on the affected hostname cannot proceed. The safety error also correctly prevents switching to another browser surface as a workaround, so there is no automated recovery path.

Environment
  • ChatGPT/Codex desktop app on Windows
  • Built-in Browser plugin
  • Authenticated Google Play Console session

No account identifiers, private Play Console URLs, cookies, credentials, or session logs are included in this report.

Dominant language
Rust
Stars
125k
Forks
19.5k
Avg merge
1m
Merged PRs (30d)
1k

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openai/codex

All issues in openai/codex

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.