CVE-2025-7021

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-7021
Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input (e.g., login credentials, email addresses) via displaying a deceptive fullscreen interface with overlaid fake browser controls and a distracting element (like a cookie consent screen) to obscure fullscreen notifications, tricking the user into interacting with the malicious site.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/google/security-research/security/advisories/GHSA-mmgx-755h-wr74 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openai:operator:-:*:*:*:saas:*:*:*
History

24 Jul 2025, 19:13

Type Values Removed Values Added
First Time Openai
Openai operator
References () https://github.com/google/security-research/security/advisories/GHSA-mmgx-755h-wr74 - () https://github.com/google/security-research/security/advisories/GHSA-mmgx-755h-wr74 - Exploit, Third Party Advisory
CWE NVD-CWE-Other
CPE cpe:2.3:a:openai:operator:-:*:*:*:saas:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

15 Jul 2025, 13:14

Type Values Removed Values Added
Summary
  • (es) La suplantación de API de pantalla completa y la reparación de la interfaz de usuario en el manejo de la API de pantalla completa y la representación de la interfaz de usuario en OpenAI Operator SaaS en la Web permite a un atacante remoto capturar información confidencial del usuario (por ejemplo, credenciales de inicio de sesión, direcciones de correo electrónico) al mostrar una interfaz de pantalla completa engañosa con controles de navegador falsos superpuestos y un elemento que distrae (como una pantalla de consentimiento de cookies) para ocultar las notificaciones de pantalla completa, engañando al usuario para que interactúe con el sitio malicioso.

10 Jul 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-10 20:15

Updated : 2025-07-24 19:13

NVD link : CVE-2025-7021

Mitre link : CVE-2025-7021

CVE.ORG link : CVE-2025-7021

JSON object : View

Products Affected

openai

  • operator
CWE
CWE-451

User Interface (UI) Misrepresentation of Critical Information

NVD-CWE-Other