Later archive addition

Pwning OpenAI Atlas Through Exposed Browser Internals

s1r1us and sudi · Hacktron AI · 2 December 2025

Analyzes exposed browser internals in OpenAI Atlas, combining vendor-origin XSS and login CSRF with privileged Mojo interfaces. Demonstrated tab-URL disclosure can expose authorization codes in susceptible flows; the researchers did not achieve full UXSS or native code execution.

Record

Researcher

s1r1us and sudi

Published by

Hacktron AI

Date

2 December 2025

In the archive

• Added to the 2025 archive after the original list was published

Tags

• xss
• csrf
• oauth
• info-leak
• owasp-a01-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of s1r1us and sudi, first published at the original source. Preserved copies are kept so the citation survives its host.