As cited
Copy frozen at (site build).
threat intel
ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration
Check Point Research identified a vulnerability in ChatGPT's HTML page preview feature that allowed attackers to bypass Lockdown Mode and exfiltrate chat data to external servers. The flaw exploited nested iframes to circumvent sandbox restrictions, enabling malware delivery, phishing attacks, and silent credential theft. OpenAI deployed a fix on September 18, 2026, by removing permissive popup permissions from the sandbox.
Why it matters: ChatGPT users relying on Lockdown Mode for protection of sensitive conversations should verify they are running the patched version, as the vulnerability previously exposed entire chat histories and personal data without user awareness or notification.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration
Check Point Research identified a vulnerability in ChatGPT's HTML page preview feature that allowed attackers to bypass Lockdown Mode and exfiltrate chat data to external servers. The flaw exploited nested iframes to circumvent sandbox restrictions, enabling malware delivery, phishing attacks, and silent credential theft. OpenAI deployed a fix on September 18, 2026, by removing permissive popup permissions from the sandbox.
Why it matters: ChatGPT users relying on Lockdown Mode for protection of sensitive conversations should verify they are running the patched version, as the vulnerability previously exposed entire chat histories and personal data without user awareness or notification.
- Source published
- First seen by Cybersecurity Tracker