[macOS][Embedded browser] Native month picker crashes renderer on accessibility activation
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 125k
- Forks
- 19.4k
- PR merge metrics
- PR metrics pending
Description
What version of the Codex App are you using (From “About Codex” dialog)?
ChatGPT desktop hosting Codex: 26.915.31029 (build 9771), read from the installed application bundle.
Embedded Codex Framework version directory: 153.0.8010.48.
What subscription do you have?
Not collected for this report.
What platform is your computer?
macOS 15.8, arm64.
What issue are you seeing?
Activating the native <input type="month"> calendar popup through the embedded browser's accessibility element-index click crashes the browser renderer. The tab displays This page crashed; the tool reports Inspected target navigated or closed.
This reproduces on a standalone HTML page with no JavaScript, CSS, React, or application API calls. A coordinate-based pointer click on the same icon opens the popup without crashing. The evidence therefore points to the embedded browser's accessibility activation path; the internal failing function has not been identified.
What steps can reproduce the bug?
- Save this as
month-input.htmland serve it over localhost with a static HTTP server:
<!doctype html>
<html lang="en">
<meta charset="utf-8">
<title>Native month input reproduction</title>
<h1>Native month input</h1>
<p>No React, JavaScript, styles or API calls.</p>
<label>Month <input type="month" name="month"></label>
</html>
- Open the page in the Codex embedded browser.
- Inspect the accessibility tree with Computer Use (
cua). The native input exposes a popup-button named Show month picker. - Activate that popup-button using
await tab.click(index), whereindexis its current accessibility element index. - Observe the renderer crash.
Control: open the same page in a fresh tab and use a coordinate-based pointer click on the calendar icon. The renderer remains alive and the popup accessibility subtree appears (a three-row, four-column month table). Keyboard editing of the native month/year fields also works.
What is the expected behavior?
Accessibility activation opens the native month picker, as pointer activation does, without terminating the renderer.
Additional information
Three observed crashes (two on the original application page, one on the minimal HTML page) produced:
2026-09-18T12:57:29.885Z browser sidebar render process gone exitCode=5 reason=crashed
2026-09-18T13:07:03.959Z browser sidebar render process gone exitCode=5 reason=crashed
2026-09-18T13:07:55.415Z browser sidebar render process gone exitCode=5 reason=crashed
The exception streams from all three local Crashpad minidumps have the same exception module Codex Framework, relative exception offset 0xaf32384, exception code 0x6, and flags 0x1. This is diagnostic correlation, not a symbolicated stack trace or a claim about the root cause. Matching symbols are needed to identify the internal function.
No raw minidumps, private application source, or full session logs are attached. The local application/backend stayed running throughout.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by serving the provided month-input.html over localhost and reproducing the crash through the CUA accessibility element using await tab.click(index), then compare it with coordinate activation. The issue names no source file, test, or internal entry point; done means accessibility activation opens the native month picker without terminating the renderer, likely requiring matching symbols to identify the failing function.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html, macos
- Domain
- accessibility, desktop-dev
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100