[Windows] Browser plugins fail trusted RPC dependency validation

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #39407
• #39399
• #39414
• #39252
• #39427

Powered by Codex Action

Independent reproduction on Windows.

I can reproduce the same trusted RPC dependency failure with the bundled Browser and Chrome plugins at version 26.814.41407:

Trusted RPC dependency must resolve within a configured trusted code path:
.../browser-service.mjs

Impact:

• In-app browser control cannot initialize.
• Chrome control cannot initialize, even though the Chrome extension is installed and enabled.
• Reinstalling the extension, enabling browser control, fully restarting Codex/Chrome, and terminating remaining processes did not resolve it.
• The failure prevents a real authenticated web-administration workflow; the browser window opens and remains usable manually, but the agent cannot interact with it.

I also tested the Computer Use path. It can detect the open Chrome window, but it stops before interaction because it cannot determine the current browser URL with enough confidence to enforce policy. This leaves both browser-control paths unusable.

Expected: the official bundled browser service should initialize successfully and control authenticated browser tabs after the user has enabled the relevant permissions.

Update: tested the remaining enabled browser paths as well.

• Microsoft Edge: initialization fails with the same Trusted RPC dependency must resolve within a configured trusted code path ... browser-service.mjs error.
• Brave: the Windows Computer Use integration can detect the Brave window, but stops before it can read or interact with the page because it cannot determine the current browser URL with enough confidence to enforce policy.

Confirmed affected paths on this Windows system:

1. Codex in-app Browser
2. Google Chrome extension control
3. Microsoft Edge extension control
4. Brave through Computer Use

All enabled browser-control paths are therefore unavailable for authenticated web-administration tasks.

I can reproduce this on Windows with bundled Browser/Chrome plugin 26.814.41407.

I verified the Chrome/native-host setup is healthy:

• ChatGPT Chrome extension installed and enabled
• Extension ID matches the native-host manifest
• com.openai.codexextension registry entry exists
• Native-host manifest exists and parses correctly
• allowed_origins is correct
• extension-host.exe exists and has a valid Authenticode signature
• OpenAI’s bundled check-native-host-manifest.js reports Correct: yes
• OpenAI’s bundled check-extension-installed.js reports the extension installed and enabled
• Chrome successfully launches the native host:

chrome.exe -> cmd.exe -> extension-host.exe

Despite that, browser initialization fails with:

Trusted RPC dependency must resolve within a configured trusted code path

After the failure, Codex sometimes reports that the native-host registry/manifest or Chrome profile are missing, but direct inspection and OpenAI’s own diagnostics confirm they are present.

I also deleted and regenerated both bundled browser caches. They came back as 26.814.41407, and the issue persisted.

I tested with another browser-control extension disabled as well, with no change.

This appears to be failing after native messaging launches successfully, during Codex trusted-code-path/RPC validation rather than during Chrome/native-host installation.

Thank you — this matches our Windows reproduction closely and supports that the issue is in Codex's trusted-code-path/RPC validation, not browser setup.

In our case, the failure now also shows a version mismatch: Codex attempts to import browser-service.mjs from bundled Browser plugin 26.814.41957, but that path is absent locally. The control failure affects the in-app browser, Chrome, Edge, and Brave. Reinstalling extensions, restarting the app/browsers, and terminating residual processes did not resolve it.

This blocks authenticated browser tasks despite the Computer Use permissions and browser extensions being enabled.

Full Windows reproduction report

Impact: browser control is unavailable for authenticated administrative work (for example, Name.com), even though Computer Use and browser permissions are enabled.

Browsers affected

• In-app Browser
• Google Chrome
• Microsoft Edge
• Brave

Configuration checked

• “Any app” control enabled in Settings → Computer use.
• ChatGPT browser extensions installed and enabled for Chrome, Edge, and Brave.
• The affected browser sessions were open and signed in.

Actions already tried

1. Reinstalled the browser extensions.
2. Restarted Codex/Desktop and all browsers.
3. Terminated residual application/browser processes using Windows Task Manager.
4. Retried after reinstalling/enabling the controls.
5. Tested all four browser paths, not just Chrome.

Observed failures

• In-app Browser, Chrome, and Edge fail before a tab can be controlled due to trusted RPC / trusted code path initialization errors.
• Current error additionally shows a bundled-component version mismatch: the runtime attempts to load browser-service.mjs from Browser plugin 26.814.41957, but the module is absent locally.
• Brave is detected, but Computer Use stops before page interaction because it cannot determine the current browser URL with enough confidence to enforce policy.

The failures persist after the above recovery steps. This does not appear to be a missing extension, browser login, or user configuration issue; it appears to be an internal desktop/browser-plugin infrastructure issue. Please investigate the trusted worker component/version packaging and the trusted RPC validation path.

Thank you for the detailed confirmation. Our Windows setup reproduces
the same failure and we are adding the complete operational impact and
checks performed.

Impact: browser control is unavailable for authenticated
administrative work, even with the relevant permissions enabled.

Affected browser paths:

• In-app Browser
• Google Chrome
• Microsoft Edge
• Brave

Configuration verified:

• “Any app” control is enabled in Settings → Computer use.
• The ChatGPT browser extensions are installed and enabled for Chrome,

Edge, and Brave.

• The required browser sessions were open and signed in.

Recovery actions already tried:

1. Reinstalled the browser extensions.
2. Restarted the Codex desktop app and all browsers.
3. Closed residual Codex/browser processes via Windows Task Manager.
4. Re-enabled the controls and retried.
5. Tested all four browser paths, not only Chrome.

Observed failures:

• In-app Browser, Chrome, and Edge fail before a tab can be controlled

with trusted RPC / trusted-code-path initialization errors.

• The current error also shows a bundled-component version mismatch:

the runtime attempts to load browser-service.mjs from Browser plugin
26.814.41957, but the module is absent locally.

• Brave is detected, but Computer Use stops before any page

interaction because it cannot determine the current browser URL with
enough confidence to enforce policy.

The issue persists after the above recovery steps. This appears to be
an internal desktop/browser-plugin infrastructure issue rather than an
extension installation, browser login, or user configuration problem.

Additional Windows reproduction on 2026-08-25.

Environment:

• Platform: Windows x64
• Bundled Browser plugin: 26.818.61809
• Rejected dependency: %USERPROFILE%\.codex\plugins\cache\openai-bundled\browser\26.818.61809\scripts\browser-service.mjs

Observed error:

Trusted RPC dependency must resolve within a configured trusted code path:
file:///%USERPROFILE%/.codex/plugins/cache/openai-bundled/browser/26.818.61809/scripts/browser-service.mjs

Reproduction:

1. Start a projectless Codex Desktop task on Windows.
2. Attempt an in-app browser task targeting ChatGPT.
3. The browser runtime fails during initialization, before navigation, tab discovery, or authentication.
4. Fully restart Codex Desktop and retry.
5. The identical error persists.

Verification:

• The versioned Browser bundle directory exists.
• Both browser-client.mjs and browser-service.mjs are present in the official bundled plugin path.
• The failure therefore remains reproducible with the newer 26.818.61809 Browser bundle, not only the earlier 26.814.41407 bundle described in the original report.

Impact:

• All in-app browser interaction is blocked.
• This prevented creating and organizing ChatGPT Projects through the signed-in UI.

Privacy:

• Username, task ID, and local user path are omitted.

This comment was submitted by Codex at the account owner's explicit request after reproducing the failure multiple times.