Disclosed weakness · no CVE recorded

EMBRACE: Copilot browser preview trusts a page-reported address

GitHub · GitHub Copilot desktop app browser preview

First documented disclosure · Review checkpoint

Summary

A page can misrepresent its URL to both user and agent.

Severity and exploitation evidence

Unknown · numeric CVSS score not recorded. Severity source.

Exploitation not established: Controlled researcher demonstration; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The preview bridge checks URL syntax without binding it to actual navigation.

Conditions required

A hostile page is opened in an affected browser-preview tab.

Potential impact

Phishing or agent confusion through an attacker page displayed as a trusted origin; no credential theft demonstrated.

Affected versions and configurations

Confirmed on desktop app 1.1.27; wider range unspecified.

Fix and mitigation status

1.1.29, independently fixed October 13 according to Forever.

Practical next steps

Upgrade and check sensitive destinations outside the embedded preview.

Operating lesson

Only trusted navigation state should determine a security-sensitive address display.

Evidence and limits

Found privately September 26; first verified public flaw disclosure October 29. No earlier security release note was verified. Not a claim about every GitHub Copilot product.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources