Windows built-in browser denies geolocation after permission prompt

Summary

On Windows, websites using navigator.geolocation.getCurrentPosition() cannot obtain a position in Codex's built-in browser. The browser shows a location permission prompt and the user can choose Allow, but the request still fails.

Environment

• Windows 11 build 10.0.26200
• Installed package: OpenAI.Codex_26.707.9981.0_x64__2p2nqsd0c76g0
• Codex app release observed in diagnostics: codex@26.707.72221
• Electron/Chromium: 150.0.7871.115

Reproduction

1. Open a secure HTTPS page in Codex's built-in browser that calls:

``js
navigator.geolocation.getCurrentPosition(success, error)
``

1. Trigger the location request.
2. Accept the displayed location permission prompt.
3. Observe that the success callback does not run and the request fails.

Reproduced with: https://nearbite-web-jaret.kalishodan.chatgpt.site/

Expected behavior

After the user allows location, the browser should return a position. If geolocation is intentionally unsupported, the browser should expose that clearly without presenting an ineffective Allow flow.

Actual behavior and root-cause evidence

Windows Location Service is running and global user location consent is set to Allow.

The current installed Codex Electron bundle configures the built-in browser session with permission handlers equivalent to:

setPermissionRequestHandler((webContents, permission, callback) => {
  callback(permission === "clipboard-sanitized-write");
});

setPermissionCheckHandler((webContents, permission) =>
  permission === "clipboard-sanitized-write"
);

This explicitly denies every other web permission, including geolocation, before Windows can provide a position. The handler is in the installed app's main browser-session bundle near the built-in browser sidebar/session configuration.

Scope

The site uses a standard secure-context Geolocation API request. Windows Location Service and user-level location permission are enabled. The confirmed failure boundary is Codex's built-in browser-session permission handler.

Suggested direction

Handle geolocation as a user-mediated permission in the built-in browser session, or treat it as unsupported without displaying an ineffective permission flow.