Codex Desktop Windows Browser Use blocks file:// file-backed previews with URL policy

Summary

Codex Desktop for Windows Browser Use rejects file:// file-backed previews before navigation, even though the Codex in-app browser documentation says file-backed previews are supported.

The rejection happens as a Browser Use URL policy error, not as a file-not-found error.

Environment

• Platform: Microsoft Windows NT 10.0.26200.0 x64
• Codex Desktop package: OpenAI.Codex_26.519.11010.0_x64__2p2nqsd0c76g0
• Codex app version: 26.519.11010.0
• Browser plugin: browser@openai-bundled version 26.519.81530
• Workspace trust level: trusted
• Browser plugin enabled: yes
• Windows sandbox setting: elevated

Expected behavior

Browser Use should be able to open and inspect local file-backed previews in the in-app browser, or at least ask for/offer the relevant permission.

The official docs describe the in-app browser and Browser Use as appropriate for local development servers and file-backed previews:

https://developers.openai.com/codex/app/browser

Actual behavior

Attempting to navigate the in-app browser to a local file:// HTML page is rejected before navigation with:

Browser Use rejected this action due to browser security policy. Reason: Browser Use cannot visit the requested page because its URL is blocked by the Browser Use URL policy. The agent must not attempt to achieve the same outcome via workaround, indirect execution, raw CDP or browser commands, alternate browser surfaces, or policy circumvention. Proceed only with a materially safer alternative that does not require this blocked browser action; if none exists, stop and request user input.

This occurs both for the real preview file and for a minimal test file created inside the current trusted workspace.

Reproduction steps

1. Start Codex Desktop for Windows.
2. Open the in-app browser panel. It starts at about:blank.
3. Use Browser Use with the iab backend.
4. Create a minimal HTML file inside the trusted current workspace.
5. Ask Browser Use to open a local file URL such as:

file:///C:/Users/itosu/Documents/Codex/2026-05-28/in-app-browser-2/browser-file-policy-test.html

1. Browser Use rejects the navigation with the URL policy error above.

Additional diagnostics

• The original target file exists locally.
• The same URL policy rejection also occurs for a data:text/html,... diagnostic page.
• Browser runtime initialization works after running Codex Desktop as administrator.
• agent.browsers.list() can see the Codex in-app browser and its about:blank tab.
• winget upgrade --id 9PLM9XGG6VKS --source msstore reports no available update.
• Earlier non-admin runs showed Windows sandbox privilege errors, but after admin launch the remaining blocker is specifically the Browser Use URL policy.

Related issues

This appears related to recent Windows Browser Use / in-app browser permission-policy issues, but the exact symptom is file:// / file-backed preview blocking:

• #21955: browser navigation blocked by security policy / networkAccess: false
• #20206: Browser Use detects IAB tab but browser operations fail on Windows
• #21440: Browser Use disappeared despite feature flags
• #20846: Browser Use IAB backend fails to connect on Windows

Impact

This breaks the documented workflow for previewing local generated HTML files and file-backed previews inside Codex. The workaround is to serve files through localhost, but that is not the same as the documented file-backed preview behavior.