CVE-2025-7021

Description

Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input (e.g., login credentials, email addresses) via displaying a deceptive fullscreen interface with overlaid fake browser controls and a distracting element (like a cookie consent screen) to obscure fullscreen notifications, tricking the user into interacting with the malicious site.

Reserved 2025-07-02 | Published 2025-07-10 | Updated 2025-07-10 | Assigner Google

Problem types

CWE-451 : User Interface (UI) Misrepresentation of Critical Information

Product status

Default status
unaffected

SaaS
affected

References

github.com/...search/security/advisories/GHSA-mmgx-755h-wr74

cve.org (CVE-2025-7021)

nvd.nist.gov (CVE-2025-7021)

Download JSON