ChatGPT HTML Preview nested frames permitted popup escape and outbound egress

A nested iframe in ChatGPT HTML Preview could invoke a child contentWindow.open path that bypassed the parent popup interception logic while sandbox policy still permitted popup escape.

Check Point demonstrated controlled outbound web egress and phishing-style popups under this configuration, with an Electron client variant opening without gesture. OpenAI removed the unsafe permissions in September 2026; the experiment was not a reported user compromise.

The egress bypass exploited two different trust assumptions at once. The outer HTML Preview sandbox still allowed a popup to escape into an ordinary browser context, and the parent-side interception only covered one way of calling window.open. A malicious nested iframe could invoke the child window's method and reach a destination beyond the preview. Check Point's report describes controlled outbound requests and phishing-style popups, with an Electron client variant lacking a user-gesture requirement. OpenAI reportedly removed the relevant popup permissions in September, before the public November disclosure. This is a controlled harness/browser failure, not a confirmed customer compromise, and it is separate from earlier cross-frame ChatGPT preview incidents.

The popup restriction failed at a nested browser context: the outer frame's interceptor did not cover the inner frame's window.open path, while the sandbox still permitted popup escape. That creates a different exposure from a prompt merely asking the assistant to reveal a secret; it changes where rendered HTML can navigate or send data. Check Point's September 18 fix removed the relevant popup permissions, before the November disclosure. The demonstration showed an egress path and phishing-style windows, not a verified incident involving real users' conversation theft.