Check Point Finds ChatGPT Lockdown Mode Bypass Enabling Zero-Click Data Exfiltration, Phishing and Malware Delivery
Check Point Research disclosed a vulnerability in ChatGPT's HTML-preview sandbox that allowed attackers to bypass Lockdown Mode, OpenAI's advanced setting meant to block prompt-injection-based data exfiltration. By nesting an additional iframe and invoking its contentWindow.open function, an attacker could escape the sandbox restrictions (allow-popups, allow-popups-to-escape-sandbox) and open popups displaying arbitrary attacker-controlled content inside the trusted ChatGPT interface. The flaw enabled covert exfiltration of entire chat histories and uploaded files, phishing via spoofed application windows disguised as legitimate ChatGPT update prompts, and credential theft by forcing user sign-out and re-authentication on attacker-controlled pages. In the Electron-based ChatGPT Classic app, the exploit required zero user interaction, as window.open could be triggered silently, merely having a conversation with a malicious GPT or shared chat was enough to trigger data exfiltration to an attacker server. The attack could be delivered through a malicious prompt, a malicious GPT, or a shared chat, and was demonstrated against both the browser and desktop clients.
Entenda a falha
A vulnerabilidade
No CVE was assigned. The flaw is a sandbox escape in the HTML-preview feature for code blocks in ChatGPT (browser and the Electron-based ChatGPT Classic app). It bypasses Lockdown Mode, the optional setting meant to stop prompt-injection data exfiltration. The attacker needs the victim to open attacker-controlled content, delivered as a malicious prompt, a malicious GPT or a shared chat. In the browser the victim must click a lure, and no account is needed. In ChatGPT Classic, window.open works without a user gesture, so just having the conversation is enough. The attacker can open popups with arbitrary content, exfiltrate chat history and uploaded files, phish credentials and deliver malware disguised as an update. The fix is server-side: OpenAI deployed it on September 18, 2026, and Check Point confirmed it after retesting.
Como funciona
When a code block contains HTML, ChatGPT renders it in a preview made of two nested sandboxed iframes, isolated from the app, cookies and localStorage. Scripts in the sandbox replace window.open, so a page that tries to open a popup is blocked until the user approves it, or gets null for empty or about:blank URLs. Image loads, external links and outbound requests are also intercepted and shown as warnings. The sandbox attributes still allow popups and popups escaping the sandbox. If the preview page creates one more iframe inside itself, that inner frame has its own untouched open function. Calling it opens a popup that skips the approval check, and because of the escape permission the popup runs outside the sandbox with attacker-chosen content, the ChatGPT icon and an attacker-chosen title.
Por que é vulnerável
The root cause is a control that rests on a wrong assumption. The sandbox granted allow-popups and allow-popups-to-escape-sandbox at the iframe level and relied on a JavaScript override of window.open in the page to gate popups. That override covers only the window object it patched, not the open function of a freshly created nested iframe. Popup restrictions were therefore enforced by replaceable script rather than by the sandbox attributes themselves. The fix removes both permissions from the outer HTML-preview sandbox iframe, so the browser itself refuses the popups.
Onde está
The flaw is in the HTML-preview sandbox of ChatGPT code blocks: the outer iframe's allow-popups and allow-popups-to-escape-sandbox permissions and the sandbox's redefined window.open; no public code or commit is named.
Como foi descoberta
Check Point Research found it, and the write-up is credited to Alexey Bukhteyev. It follows an earlier Check Point finding this year, a DNS-tunneling exfiltration flaw in ChatGPT's code-execution runtime that was promptly fixed. HTML preview was added in February 2026, and Lockdown Mode came later. Check Point reported the bypass to OpenAI through responsible disclosure. OpenAI deployed the fix on September 18, 2026, and the details were published on November 5, 2026.
PoC pública
Check Point's public write-up demonstrates the technique and walks through scenarios: silent exfiltration of chat history, a spoofed update window delivering malware, and credential theft. It also shows the zero-click variant in ChatGPT Classic. It is a research demonstration of a working bypass, not a packaged exploit tool. Because the fix is server-side and was confirmed by retesting, users have nothing to patch, and the technique no longer works against the fixed service.
Publicada em: research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/ ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 12:17.
Detalhes técnicos
OpenAI introduced HTML page preview for code blocks in February 2026, rendering user-controlled HTML/JS inside two nested sandboxed iframes to isolate it from the ChatGPT application context, cookies, and localStorage. However, the sandbox left allow-popups and allow-popups-to-escape-sandbox enabled; while the sandbox's redefined window.open blocked direct popups pending user approval, creating a nested iframe and calling its own contentWindow.open bypassed this restriction entirely, since the inner iframe's popup windows execute outside the sandbox due to the escape token. This allowed attacker-controlled popups retaining the ChatGPT app icon with attacker-controlled titles and content, as well as image/link embedding for exfiltration and phishing lures.
Remediação
Check Point Research responsibly disclosed the vulnerability to OpenAI, which deployed a fix on September 18, 2026 by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe. Check Point confirmed the exploitation technique no longer works after retesting.
Linha do tempo
-
Check Point Finds ChatGPT Lockdown Mode Bypass Enabling Zero-Click Data Exfiltration, Phishing and Malware Delivery
ler a análise desta fonte ocultar
Check Point Research disclosed a vulnerability in ChatGPT's HTML-preview sandbox that allowed attackers to bypass Lockdown Mode, OpenAI's advanced setting meant to block prompt-injection-based data exfiltration. By nesting an additional iframe and invoking its
contentWindow.openfunction, an attacker could escape the sandbox restrictions (allow-popups,allow-popups-to-escape-sandbox) and open popups displaying arbitrary attacker-controlled content inside the trusted ChatGPT interface. The flaw enabled covert exfiltration of entire chat histories and uploaded files, phishing via spoofed application windows disguised as legitimate ChatGPT update prompts, and credential theft by forcing user sign-out and re-authentication on attacker-controlled pages. In the Electron-based ChatGPT Classic app, the exploit required zero user interaction, aswindow.opencould be triggered silently, merely having a conversation with a malicious GPT or shared chat was enough to trigger data exfiltration to an attacker server. The attack could be delivered through a malicious prompt, a malicious GPT, or a shared chat, and was demonstrated against both the browser and desktop clients.Technical Details
OpenAI introduced HTML page preview for code blocks in February 2026, rendering user-controlled HTML/JS inside two nested sandboxed iframes to isolate it from the ChatGPT application context, cookies, and localStorage. However, the sandbox left
allow-popupsandallow-popups-to-escape-sandboxenabled; while the sandbox's redefinedwindow.openblocked direct popups pending user approval, creating a nested iframe and calling its owncontentWindow.openbypassed this restriction entirely, since the inner iframe's popup windows execute outside the sandbox due to the escape token. This allowed attacker-controlled popups retaining the ChatGPT app icon with attacker-controlled titles and content, as well as image/link embedding for exfiltration and phishing lures.Remediation
Check Point Research responsibly disclosed the vulnerability to OpenAI, which deployed a fix on September 18, 2026 by removing the
allow-popupsandallow-popups-to-escape-sandboxpermissions from the outer HTML-preview sandbox iframe. Check Point confirmed the exploitation technique no longer works after retesting.