Windows Codex 26.616.9593.0: in-app browser silently closes/restarts app with missing IAB route/window state

Summary

On Windows Codex Desktop 26.616.9593.0, opening the in-app browser can cause Codex to silently close/restart without a native crash dump. The local logs point to an in-app browser route/window lifecycle failure after the browser webview is created or resumed.

This looks related to other Windows IAB stability issues, but the observed trigger/evidence is different from #27828:

• This repro did not involve a Cloudflare Turnstile page.
• The in-app browser was opened to about:blank.
• No recent Crashpad dump, Sentry queued event, or Windows Application Error entry was found for Codex.
• The strongest signal is stale/missing IAB route/window state.

Environment

• OS: Windows
• Codex package: OpenAI.Codex_26.616.9593.0_x64__2p2nqsd0c76g0
• Previous package observed in update logs: OpenAI.Codex_26.616.6631.0_x64__2p2nqsd0c76g0
• Codex app-server version reported in logs: 0.142.0
• Browser plugin / IAB release in logs: 26.616.71553
• Chromium/Electron Crashpad annotation observed in process args: 149.0.7827.115
• Timezone for local observations: Asia/Shanghai

What happened

After asking Codex to open the built-in in-app browser, the browser briefly appears and Codex closes/restarts. I did not re-trigger the browser after that because opening it was causing the app to disappear.

The app was updated earlier the same day:

2026-06-23 12:18:46 Windows installed update 9PLM9XGG6VKS-OpenAI.Codex
previous package: OpenAI.Codex_26.616.6631.0_x64__2p2nqsd0c76g0
current package:  OpenAI.Codex_26.616.9593.0_x64__2p2nqsd0c76g0

Windows AppModel logs show repeated launches of the current package afterward, including one at:

2026-06-23 15:30:53
OpenAI.Codex_26.616.9593.0_x64__2p2nqsd0c76g0!App
process 30516

Expected behavior

Opening the in-app browser should keep the Codex app alive and preserve a valid browser route/session. If the browser webview fails, the failure should be isolated to the browser tab/pane and be recoverable.

Actual behavior

Codex appears to close/restart after the IAB path is exercised. The logs show the IAB startup and webview attachment path making progress, then later show missing route/window state.

Representative log signatures:

browser_use_availability_resolved available=true browserPane=true platform=Windows reason=available release=26.616.71553
browser_use_iab_backend_startup_started backend=iab platform=win32 release=26.616.71553
browser-use native pipe listening pipePath=\\.\pipe\codex-browser-use-...
browser_use_iab_backend_startup_ready backend=iab platform=win32 release=26.616.71553

The browser tab/webview path reaches creation and attachment:

IAB_LIFECYCLE iab backend request received request=createTab
IAB_TAB_ANALYTICS browser tab lifecycle action=opened appBrowserTabCount=1 appBrowserUseTabCount=1
IAB_LIFECYCLE opening route page hasStartingUrl=true
IAB_LIFECYCLE created browser sidebar page state
IAB_LIFECYCLE waiting for browser sidebar webview attachment
IAB_LIFECYCLE received browser sidebar webview host created hostKind=right-panel initialUrl=about:blank
IAB_LIFECYCLE did attach browser sidebar webview guestWebContentsId=2
IAB_LIFECYCLE runtime attached browser sidebar webview
IAB_LIFECYCLE host opened page
IAB_LIFECYCLE iab createTab mapped page to tab tabId=1 webContentsId=2

In another run around the apparent close/restart point, the route/window state disappears:

IAB_LIFECYCLE ended browser use session activity disposeAfterSessionActivity=false
IAB_LIFECYCLE route window is not live hasWindowState=false ownerDestroyed=null windowDestroyed=null windowId=1
IAB_LIFECYCLE browser use route window missing for cursor state
IAB_LIFECYCLE browser use route window missing for active state
IAB_LIFECYCLE removed browser session window windowId=1
Stopping app-server transport connectionId=1 transport=stdio
app_server_connection.state_changed cause=stop_process previous=connected next=disconnected

A later IAB request also shows:

IAB_LIFECYCLE iab backend info request failed
errorMessage="No Codex browser route is available for browser session ..."

Crash artifact observations

I did not find a useful native crash artifact for this failure:

• %LOCALAPPDATA%\CrashDumps: no matching Codex dump found.
• Codex Crashpad reports directory exists, but no recent report was present.
• Codex Sentry queue was empty: [].
• Windows Application log did not show a Codex Application Error event for the inspected period.

So this may be a silent window/session teardown or unreported app restart rather than a normal native crash.

Secondary observation: plugin cache lock

There is also a likely separate plugin-cache lifecycle issue. A Chrome extension native host process stayed running from Codex plugin cache:

extension-host.exe
path: C:\Users\...\ .codex\plugins\cache\openai-bundled\chrome\latest\extension-host\windows\x64\extension-host.exe
started: 2026-06-23 12:43:00

Later Codex logs show the bundled marketplace refresh failing because the copied extension-host directory was locked:

plugin_marketplace_folder_remove_failed
plugin_marketplace_folder_write_failed
bundled_plugins_marketplace_resolve_failed
errorCode=EBUSY
errorMessage="EBUSY: resource busy or locked, rmdir '...\openai-bundled\plugins\chrome\extension-host\windows\x64'"

This may be unrelated to the IAB close/restart, but it suggests plugin cache updates can be blocked by a long-running extension host process.

Security note

I do not currently have evidence that this is a security vulnerability. No sandbox escape, data disclosure, code execution, or attacker-controlled trigger was demonstrated. This is being reported as a reliability/product bug.