Gmail
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by Cyber Security NewsCritical ChatGPT flaw let one malicious link access private chats; OpenAI has fixed it
Recent news
Critical ChatGPT flaw let one malicious link access private chats; OpenAI has fixed it
A critical ChatGPT vulnerability allowed attacker-controlled JavaScript to run in a victim's signed-in session via a malicious shared conversation. It could list and read private conversations and exfiltrate data to an external server, with a single link sufficing in the demonstration. OpenAI fixed it on 26 October 2026 after a report from Parameter, which received a $5,000 bounty.
VOLTA infostealer uses a commercial AI model to profile victims after stealing their sessions
Cisco Talos published details on 31 October 2026 of VOLTA, a Windows infostealer that takes browser credentials, cookies and tokens for Gmail, Discord, Slack, Steam, Telegram and others. It uses the victim's Gmail session to find order receipts and confirm home addresses, then sends a summary file to OpenRouter, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash, to produce a ranked victim assessment. Talos believes VOLTA is sold as a builder and did not confirm whether it has been used in the wild.
VOLTA infostealer uses an LLM to rank stolen victim data by monetisation value
VOLTA, also called VOLTA-AUTODOXER, is a self-deleting Windows infostealer that harvests browser credentials, cookies, payment cards, crypto wallet seed phrases, chat and gaming sessions, OAuth tokens, SSH and cloud keys, and Wi-Fi passwords. It sends a structured evidence bundle to an LLM via OpenRouter, which produces a ranked target assessment, and falls back to other models if one refuses. The malware also uses stolen sessions to enrich the data, for example by searching Gmail for receipts to confirm a home address.
Google urges users to run a Security Checkup to review Gmail inbox access
Google's Safety and Security blog promotes its Security Checkup tool, which lets users review who has access to their Gmail inbox in around two minutes. The post frames it as a three-step process to protect email accounts. The article provides no details on specific threats or vulnerabilities.