Security vulnerabilities in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code, and Claude Desktop could allow for code execution, file theft, and address-bar spoofing on developer machines This article explores vulnerabilities embedded browsers. . The findings, published on October 29, reveal how browser features integrated into AI assistants can bypass security boundaries when granted elevated access to their host applications.
The researchers dubbed this attack class EMBRACE, a play on the idea of an embedded browser that behaves as if it were a genuine one.
These vulnerabilities stem from a shared design flaw: features intended to assist with previewing projects, reading pages, and tracking tabs have inadvertently granted untrusted content elevated privileges. The Forever report reveals a Cursor window.cursorBrowser.send() bridge vulnerability that enables any loaded page to inject content into the agent's instruction box without requiring user interaction. The visible elements appear harmless, but the agent receives command fragments and instructions to assemble them into an npm installation command.
A single Enter keypress can trigger execution. Proof of concept: `preinstall` script triggered Calculator from a fresh boot, leaving an empty workspace (source: Forever security) This success was contingent on the model and was not guaranteed. Claude Desktop and Visual Studio Code restricted access to files on the main page but failed to apply the same checks inside web workers, which run scripts in the background.
