openai / openai/codex

ChatGPT needs dubious access to other's app data while using Chrome extension

Open
#43,940 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

app browser bug
Dominant language
Rust
Stars
125k
Forks
19.4k
PR merge metrics
PR metrics pending

Description

What version of the Codex App are you using (From “About Codex” dialog)?

26.901.51231

What subscription do you have?

Plus

What platform is your computer?

Darwin 25.6.2 arm64 arm

What issue are you seeing?

When trying to use Chrome extension to browse a site, the extensions doesn't work reporting that there is a sys admin block that prevents access to the page even if the page is explicitly whitelisted and there is no block on the page. Also the extensions is activated but never loads the page itself from either ChatGPT desktop app nor chrome extensions active on the very page with everything whitelisted.

The only thing I could notice is a macOS gatekeeper warning that I've intentionally not allowed because is simply too much of a permission and therefore I believe this is a security concern. Not willing to accept on an attempt to prove if that solves the issue.

Image

Unrelated: while using codex I see random Apple Music libraries access requests through gatekeer.

FYI: Claude works flawlessly with the same approach and its extension on the same machine.

What steps can reproduce the bug?

Feedback ID: 01a081d9-e19d-7962-a342-c0be29958777

What is the expected behavior?

Chrome extensions can access the page.

Additional information

Originally I set extensions to only allow access on click. Now I've reinstalled and reloaded the page with Always access site settings. Nothing.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with feedback ID 01a081d9-e19d-7962-a342-c0be29958777 and reproduce on Darwin 25.6.2 arm64 with the Chrome extension and the reported site-access settings. Compare the sysadmin block and Gatekeeper or Apple Music permission requests; done means the extension loads an explicitly whitelisted page without requiring excessive unrelated access.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos, rust
Domain
desktop, security, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.