---
title: Check Point: ChatGPT's HTML preview could open an unsandboxed popup, bypassing Lockdown Mode to exfiltrate whole chats, with zero clicks in the ChatGPT Classic app | ctxsec
url: https://ctxsec.com/items/checkpoint-chatgpt-lockdown-mode-bypass-html-preview-popup-escape
description: "Check Point found that ChatGPT's HTML code-block preview ran in a sandboxed iframe that still allowed popups and popups escaping the sandbox. ChatGPT wrapped window.open, but a page could create a nested iframe and call its unwrapped open() to get a real popup whose HTML ran outside the sandbox, defeating Lockdown Mode's block on outbound requests. A malicious prompt, custom GPT or shared chat could use it to send chat history and uploaded files to an attacker, show fake update windows that keep ChatGPT's icon, or log the user out and phish their password. In the Electron ChatGPT Classic app, popups needed no user gesture, so a conversation alone could trigger exfiltration. OpenAI removed the two popup permissions on Sept 18; Check Point confirmed the fix."
status: "confirmed research (Check Point Research, Nov 5); fixed by OpenAI Sept 18"
published: 2026-11-05
---

> Check Point found that ChatGPT's HTML code-block preview ran in a sandboxed iframe that still allowed popups and popups escaping the sandbox. ChatGPT wrapped window.open, but a page could create a nested iframe and call its unwrapped open() to get a real popup whose HTML ran outside the sandbox, defeating Lockdown Mode's block on outbound requests. A malicious prompt, custom GPT or shared chat could use it to send chat history and uploaded files to an attacker, show fake update windows that keep ChatGPT's icon, or log the user out and phish their password. In the Electron ChatGPT Classic app, popups needed no user gesture, so a conversation alone could trigger exfiltration. OpenAI removed the two popup permissions on Sept 18; Check Point confirmed the fix.

[← Context & Harness Attacks](/context) · [markdown](/items/checkpoint-chatgpt-lockdown-mode-bypass-html-preview-popup-escape.md)

confirmed research (Check Point Research, Nov 5); fixed by OpenAI Sept 18

2026-11-05

### Check Point: ChatGPT's HTML preview could open an unsandboxed popup, bypassing Lockdown Mode to exfiltrate whole chats, with zero clicks in the ChatGPT Classic app

Lockdown Mode and sandboxing reduce risk but every rendering feature added to an AI client is new attack surface. For teams: be wary of shared chats and custom GPTs from outside the org, keep sensitive data out of assistants that render untrusted HTML, and when you build agent UIs, sandbox previews without `allow-popups` / `allow-popups-to-escape-sandbox` and block `window.open` at the iframe level, not by wrapping the function.

Sources: [Check Point Research: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration (Nov 5)](https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/)