[macOS][Browser] In-app browser tab stuck on ERR_UNSAFE_PORT error page: navigate-away and tab.close() are both rejected by URL policy

What version of the Codex App are you using (From “About Codex” dialog)?

26.825.31414 (build 7287)

What subscription do you have?

Pro

What platform is your computer?

Darwin 25.6.0 arm64 arm (macOS 26.6.2, build 25G83)

What issue are you seeing?

When an in-app browser tab is navigated to a Chromium-blocked port, Chromium correctly refuses the navigation with ERR_UNSAFE_PORT and renders its internal error page, which has a data: URL. That part is expected.

After that, the tab becomes unmanageable through the Browser API: the browser-side URL policy rejects both navigating the tab away to an ordinary https: page and tab.close(). The tab stays in browser.tabs.list() for the rest of the turn and can only be abandoned to end-of-turn cleanup. Creating a fresh tab works, so the browser connection itself is healthy.

The defect is not the unsafe-port rejection, it is that a tab whose current URL is an internal error page can no longer be navigated or closed.

What steps can reproduce the bug?

With the in-app browser (browser@openai-bundled, backend iab):

1. const tab = await browser.tabs.new()
2. await tab.goto("http://127.0.0.1:1/") — Chromium returns ERR_UNSAFE_PORT and renders its internal data: error page.
3. await tab.goto("https://example.com/") — rejected by the browser URL policy instead of navigating.
4. await tab.close() — also rejected, so the tab cannot be cleaned up.
5. await browser.tabs.list() still lists the tab.

What is the expected behavior?

• tab.close() should always be able to close an agent-created tab, regardless of the tab's current URL.
• Navigating away from an internal error page to an allowed http:/https: target should be permitted.

In other words, the URL policy should gate the navigation target, not block recovery operations because of the URL the tab currently happens to be showing.

Additional information

In the shipped plugin (browser@openai-bundled 26.825.31414), scripts/browser-service.mjs contains an allow-list of about:blank, http: and https: and raises navigation_url_policy_blocked (“cannot visit the requested page because its URL is blocked by the … URL policy”) for anything else. Chromium's blocked-port error page is served from a data: URL, which fails that predicate, so it appears the policy check is applied to the tab's current URL rather than only to the requested target.

Start with scripts/browser-service.mjs and reproduce the listed sequence using browser.tabs.new(), tab.goto(), tab.close(), and browser.tabs.list(). Trace the URL-policy checks around the Chromium ERR_UNSAFE_PORT data: error page. Done means an agent-created tab can close and can navigate from that internal error page to an allowed http: or https: target.