[Windows Desktop] App crashes after third-party OAuth callback in the in-app browser (Naver and Google)

What version of the Codex App are you using (From “About Codex” dialog)?

Installed Windows package version: 26.903.8094.0, identified from the running ChatGPT.exe installation path. The About dialog version was not separately checked.

What subscription do you have?

Not collected for this report.

What platform is your computer?

Microsoft Windows 10 Pro, version 10.0.19045, build 19045, x64.

What issue are you seeing?

The entire desktop app exits when a third-party social-login flow returns to Mapianist in the in-app browser. Two separate crashes were verified in the same session, first with Naver and then with Google after reopening the app.

Both desktop logs show the OAuth callback becoming ready, followed within milliseconds by IAB_LIFECYCLE browser sidebar guest torn down. Each incident has a corresponding Crashpad sidecar with capture_kind: crash and ptype: browser.

The Google callback contained error=access_denied. Successful authentication is therefore not established for that attempt. An unsuccessful or canceled OAuth flow should still leave the desktop app running. The Naver authentication result was not independently verified.

What steps can reproduce the bug?

Observed sequence on the affected machine:

1. Open https://www.mapianist.com/ in the Codex in-app browser.
2. Open the site's login dialog and select Naver.
3. Interact with the provider login flow and return to the site's OAuth callback.
4. The desktop app disappears around the time the login browser guest is torn down.
5. Reopen the desktop app and try the site's Google sign-in option.
6. The Google flow returns to the site's callback with error=access_denied; the browser tab is removed and the desktop app exits again.

This documents two actual incidents, not a controlled claim that every attempt or every website is affected. Further crash reproduction has not been attempted.

What is the expected behavior?

The desktop app, active tasks, and parent browser tab remain available when an OAuth popup finishes or closes, including when authentication is denied or canceled. The website should handle the authentication outcome without terminating the desktop app.

Additional information

Sanitized evidence

All times below are UTC on 2026-09-10 (local time was 2026-09-11, UTC+09:00). These are selected event messages; unrelated fields and identifying values have been omitted.

Naver incident:

15:47:57.632Z browser sidebar dom-ready
  url=https://papi.mapia.io/v2/auth/naver/web/sign-in/redirect?[redacted]
15:47:57.703Z IAB_LIFECYCLE browser sidebar guest torn down
15:47:57.772Z IAB_LIFECYCLE rebound browser sidebar window
15:47:58.551Z corresponding Crashpad sidecar last-write time

Google incident:

15:57:05.617Z browser sidebar dom-ready
  url=https://papi.mapia.io/v2/auth/google/sign-in/redirect?[redacted]
15:57:05.642Z IAB_LIFECYCLE browser sidebar guest torn down
15:57:05.735Z IAB_LIFECYCLE renderer disposed browser sidebar webview
15:57:05.735Z IAB_LIFECYCLE renderer removed browser sidebar webview
15:57:05.736Z IAB_TAB_ANALYTICS browser tab lifecycle action=closed
15:57:06.371Z corresponding Crashpad sidecar last-write time

Both sidecars contain:

{"capture_kind":"crash","osarch":"x86_64","ptype":"browser"}

No native stack trace or exception code was obtained. The timing suggests an OAuth browser-guest teardown/lifecycle path worth investigating, but it does not establish the root cause.

Possibly related: #30178 describes a Windows in-app browser crash during ordinary webview attach/navigation. This report adds a later app version and a specific third-party OAuth callback/guest-teardown trigger across two providers; a shared root cause has not been established.

Full callback query strings, authorization codes/state, credentials, account identifiers, local user/project paths, task identifiers, and raw session logs are excluded.

Start by reproducing the Naver or Google OAuth callback in the Windows in-app browser and inspect the desktop logs around IAB_LIFECYCLE browser sidebar guest torn down and renderer disposal. Compare the behavior with issue #30178; done means denied or canceled OAuth callbacks leave the desktop app, active tasks, and parent browser tab running.