CVE-2025-7021
MEDIUM EPSS 21.6%
Published Jul 10, 202511mo ago · Modified Jun 17, 20262w ago
6.9 CVSS 4.0
Published Jul 10, 2025 11mo ago
Last Modified Jun 17, 2026 2w ago
Description
Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user input (e.g., login credentials, email addresses) via displaying a deceptive fullscreen interface with overlaid fake browser controls and a distracting element (like a cookie consent screen) to obscure fullscreen notifications, tricking the user into interacting with the malicious site.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction P
Scope X
Threat Intelligence
EPSS Exploit Probability
21.6% percentile
Exploit & Patch Status
Public Exploit Known
No Patch Available
Weaknesses 1
CWE-451
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| openai | operator | * | any |
References 1
- github.com https://github.com/google/security-research/security/advisories/GHSA-mmgx-755h-wr74
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.