[Windows][Codex Desktop 26.810.7004.0] Clicking “Change address” in the in-app browser email picker crashes the main browser process

What version of the Codex App are you using (From “About Codex” dialog)?

• Microsoft Store package: OpenAI.Codex_26.810.7004.0_x64
• Desktop/browser release observed in logs: 26.810.52044
• Bundled codex-cli: 0.148.0-alpha.9

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Microsoft Windows 11 Pro, version 10.0.26200, x64

What issue are you seeing?

Clicking Change address in the saved-email/address suggestion UI inside the Codex in-app Browser deterministically terminates the entire Codex Desktop application.

The browser and local registration page work normally until that specific action. Selecting the already displayed email does not need the failing path; the crash occurs when Change address is clicked to choose a different address.

The trigger reproduced twice after the app had already been updated. The original unexplained exit also occurred before the update, so the update itself did not cause the first incident.

This is a native Chromium/Electron browser-process crash, not merely a page-renderer failure or a JavaScript exception. Both reproductions generated Codex Crashpad sidecars containing:

{"capture_kind":"crash","osarch":"x86_64","ptype":"browser"}

The whole AppX container was destroyed and Codex relaunched after each crash.

What steps can reproduce the bug?

1. Open Codex Desktop on Windows.
2. Open a local registration page in the right-side in-app Browser. The reproduced page was a local HTTP page at http://localhost:3000/register.
3. Focus the email field so the saved-email/address suggestion UI appears.
4. Do not choose the email already shown.
5. Click Change address.
6. The entire Codex Desktop app exits immediately and must relaunch.

Observed reproduction rate for this exact action: 2/2.

Crash times on 2026-08-18 (Europe/Istanbul, UTC+3):

• 02:22:56 — Crashpad report ID 75cdaf60-1660-4d0b-86cf-112dfcc7de03
• 02:24:18 — Crashpad report ID 918405af-6449-44c9-b877-192157b386ad

The first page reached DOM-ready at approximately 02:22:47, and the second at approximately 02:24:14. Desktop logs then end abruptly without a handled JavaScript exception.

What is the expected behavior?

The address chooser should open and permit selecting another saved address.

If that native picker or browser operation fails, the failure should be isolated to the browser tab/session. It must not terminate Codex Desktop or interrupt other running tasks.

Additional information

Evidence that narrows the failure boundary:

• Both Crashpad sidecars identify ptype: browser, which is the Chromium/Electron main browser process rather than the website renderer.
• The local Vite service remained alive and continued listening on port 3000 across both crashes.
• Six direct HTTP requests to the registration page returned HTTP 200 in approximately 16–27 ms.
• No matching Windows Application Error, WER report, or surviving .dmp was found.
• No Code Integrity Event 3033/3089 occurred during the 02:20–02:26 crash window, so this does not match the known vk_swiftshader.dll signing/GPU failure sequence.
• Approximately 5 GiB of system memory remained available. Other Codex/task memory usage may increase general sluggishness, but it does not explain the identical action-triggered crashes.

Likely failure boundary: the embedded Chromium address/autofill picker or its handoff to the Codex browser host. The exact native faulting function cannot be established without a preserved minidump.

Workaround:

• Avoid clicking Change address in the in-app Browser.
• Type the address manually when possible.
• Otherwise complete that specific registration step in an external browser.

Related reports:

• #30178 — native Codex in-app Browser main-process crashes during webview navigation.
• #38175 — in-app Browser crashes on localhost on the same Store build.

This report is distinct because ordinary page loading and interaction remain functional; the deterministic trigger is the Change address action in the email/address picker.

No email address, task ID, repository name, authenticated page contents, or private logs are included.