OpenAI Atlas CVE-2026-11326

Three specific conditions must all be satisfied: (1) the victim must have OpenAI Atlas version prior to 1.2025.288.15 installed and active in their browser; (2) the attacker must have a viable XSS injection point on forum.openai.com - a separate, prerequisite vulnerability on that platform - through which a malicious script can be served; (3) the victim must passively browse to the XSS-affected forum.openai.com page (UI:P - passive user interaction, such as visiting a link or loading a page, is required). Limiting factors: exploitation is not automatable (AU:N per CVSS 4.0 supplemental), attack complexity is rated high (AC:H) due to the chained XSS dependency, and impact is scoped to the victim component only (SC:N, SI:N, SA:N) - the attacker cannot pivot to other systems. There is no authentication requirement for the attacker (PR:N), but the target must be a specific Atlas user visiting the specific vulnerable forum content.

The CVSS 4.0 score of 6.0 reflects a moderate-severity finding. Key attenuating signals: AC:H indicates high attack complexity due to the prerequisite XSS chain; UI:P requires passive victim interaction (browsing the malicious forum page); and AU:N confirms the attack is not automatable. Impact is limited to VC:H (confidentiality of the vulnerable component - browser history exposure) with no integrity or availability impact (VI:N, VA:N, SC:N, SI:N, SA:N). The CVSS 4.0 supplemental metrics reinforce low urgency: U:Green, RE:L (low recovery effort), and V:D (diffuse value density, meaning broad but low-value targeting). EPSS at 0.02% (4th percentile) is consistent with the high complexity bar. There is no CISA KEV listing. A public blog post at hacktron.ai describes the attack technique, which elevates awareness risk but is not confirmed as weaponized exploit code. Overall: real vulnerability with meaningful confidentiality impact, but practical exploitation requires chaining two conditions (Atlas installed AND forum XSS reachable), making mass exploitation unlikely and targeted attacks the realistic threat model.

An attacker identifies or plants an XSS payload on forum.openai.com, then lures a target user with OpenAI Atlas (< 1.2025.288.15) installed to view the malicious forum content. When the victim passively browses the compromised forum page, the injected script executes within the *.openai.com trust context recognized by Atlas and invokes the privileged browser APIs, silently exfiltrating the victim's browser history or manipulating their open tabs. The hacktron.ai security blog documents this attack surface, suggesting the technique is publicly known, though a ready-to-use exploit has not been confirmed.