Summary by Moch_Azril
A UI security issue was identified in ChatGPT Atlas for macOS involving the interaction between full-screen notifications and the macOS screen-recording permission prompt.
Under certain conditions, a malicious webpage can enter full-screen mode and trigger a screen-recording permission request. The resulting system permission dialog may visually overlap or obscure the application's full-screen notification.
This creates an opportunity for UI deception: webpage-controlled content can be positioned in a way that may cause the user to misunderstand the context of the security-sensitive permission request. An attacker could potentially use this behavior to make a permission request appear associated with a different action or application state.
A proof of concept was provided to demonstrate the behavior.
The report was submitted to the vendor for investigation and remediation. This disclosure summary intentionally omits detailed exploitation instructions and the PoC URL to reduce the risk of misuse.
The issue should be considered resolved before public disclosure.