Check Point finds ChatGPT Lockdown Mode bypass in desktop app

Check Point Research discovered a vulnerability in ChatGPT that allowed attackers to bypass the recently introduced Lockdown Mode security feature. The flaw enabled silent chat history exfiltration, credential theft via phishing, and malware delivery by exploiting permissive sandbox settings in HTML page previews. OpenAI subsequently deployed a fix by removing the problematic popup permissions from the outer sandbox iframe. Open article →