Windows Codex Chrome extension backend lists profiles but seller.shopee.co.id navigation is blocked by enterprise network policy

What version of the Codex App are you using?

Codex Windows app package:

OpenAI.Codex 26.527.3686.0
PackageFullName: OpenAI.Codex_26.527.3686.0_x64__2p2nqsd0c76g0

Local bundled Chrome plugin cache:

C:\Users\<user>\.codex\plugins\cache\openai-bundled\chrome\26.527.31326

Relevant local config excerpt:

[plugins."chrome@openai-bundled"]
enabled = true

[plugins."browser@openai-bundled"]
enabled = true

[plugins."computer-use@openai-bundled"]
enabled = true

[windows]
sandbox = "elevated"

What platform is your computer?

Windows x64, Microsoft Store Codex app.

What issue are you seeing?

The Codex Chrome plugin / Codex Chrome Extension is active enough for the agent to discover multiple live Chrome extension-backed browser profiles and read their metadata.profileName values. The user asked Codex to select an already-running Chrome profile by profileName, create a new tab in that profile, and open Shopee Seller Center:

https://seller.shopee.co.id/portal/settings/shop/rating?pageNumber=1&fromPageNumber=1&cursor=0&pageSize=20&replied=TO_REPLY&ratingStar=ALL&ratingStar=5&ratingStar=4&ratingStar=3&ratingStar=2&ratingStar=1

agent.browsers.list() returned two extension-backed Chrome profiles, plus the in-app browser. The extension profile metadata included:

{
  "name": "Chrome",
  "type": "extension",
  "metadata": {
    "extensionId": "hehggadaopoacecdllhhajmbjkdcmajg",
    "profileName": "<redacted profile name>",
    "profileIsLastUsed": "true"
  }
}

and another Chrome profile with profileIsLastUsed: false. So the extension/backend discovery and profile metadata path appear to be working.

However, after selecting the intended extension browser and calling browser.tabs.new() followed by tab.goto(...), Browser Use rejected navigation before page load with:

Browser Use rejected this action due to browser security policy. Reason: Browser Use cannot access https://seller.shopee.co.id because enterprise network policy blocks it. The agent must not attempt to achieve the same outcome via workaround, indirect execution, raw CDP or browser commands, alternate browser surfaces, or policy circumvention. Proceed only with a materially safer alternative that does not require this blocked browser action; if none exists, stop and request user input.

This is a personal marketplace seller account workflow, not a managed enterprise workspace. The user was not trying to bypass the policy; they were trying to understand where the allowlist is configured. Searching the local Codex config did not reveal any allowed_domains, network_allowlist, or similar setting, and chrome@openai-bundled is already enabled.

Expected behavior

One of these should happen:

1. The Chrome extension-backed Browser Use session should be allowed to navigate to ordinary user-authorized sites such as https://seller.shopee.co.id when the user explicitly asks and the Chrome profile is already signed in, or
2. Codex should expose a clear UI/admin setting for allowed browser automation domains, or
3. The error should explain where the user/admin can safely allowlist the blocked domain.

Actual behavior

The Chrome extension backend is discoverable and reports live profile metadata, but navigation to https://seller.shopee.co.id is blocked by an enterprise network policy. There is no visible local config entry or Codex UI path surfaced to the user for allowing the domain.

Repro steps

1. Use Codex Windows app from Microsoft Store.
2. Enable chrome@openai-bundled in local config.
3. Have multiple Chrome profiles running with the Codex Chrome Extension installed/enabled.
4. In Codex, list available browsers via the Chrome plugin runtime.
5. Observe extension-backed Chrome profiles are listed with metadata.profileName.
6. Select one extension-backed profile by profileName.
7. Create a new tab and navigate to https://seller.shopee.co.id/....
8. Navigation is rejected with enterprise network policy error before page load.

Related issues

This appears related to enterprise network policy / Browser Use provisioning issues on Windows, but this case is slightly different because the Chrome extension backend is discoverable and profile metadata is available:

• #24814
• #24969
• #24559

Requested clarification / fix

Please clarify whether seller.shopee.co.id and other authenticated marketplace seller-center domains are intentionally blocked for personal accounts, or whether this is a Windows app / Chrome plugin Browser Use policy provisioning bug.

If it is expected policy behavior, please expose a user-facing allowlist/admin path in Codex settings and document how to safely allow a domain for Chrome extension browser automation.