ChatGPT can use a browser tab you mention, and Work can act in five browsers

On 15 October 2026, The Verge reported that OpenAI had updated the ChatGPT browser extension so ChatGPT can use information from open browser tabs, and so ChatGPT Work can control Chrome tabs. Stevie Bonifield’s story is timestamped 22:43 UTC. The mechanics below are from OpenAI’s browser extension documentation, opened on 16 October 2026. Where the two use different words, each is marked.

Browsers, side chat, and tab mentions

The docs say the extension works in Google Chrome, Microsoft Edge, Brave, Opera, or Vivaldi, from the ChatGPT desktop app. All five support tab mentions and browser control from the desktop app. Chrome, Edge, Brave, and Vivaldi also support side chat. Opera does not: those tasks start in the desktop app. Availability can depend on rollout and workspace settings. The page does not name a ChatGPT plan or a country list.

Chats started in side chat are available in the ChatGPT app, and recent ChatGPT chats can be opened there. The Verge describes the sidebar as having “the full power of ChatGPT” and “your entire conversation history in Chat or Work.” The docs say “recent ChatGPT chats.”

To hand ChatGPT a page, mention an open tab in the desktop app. In browsers with side chat you can also mention tabs, bring highlighted text into the chat, or right-click and choose Ask ChatGPT. The Verge says ChatGPT can view tabs when you tag Chrome in the web or desktop app, and it describes a demo that compares three open tabs. The docs page does not describe that control in the web app. In the side-chat section the docs say “ChatGPT can use context from your open tabs when a task needs it.” That is wider than one mentioned tab. It does not say the extension reads every open tab on its own, or a tab you have not brought into the task.

Work and Codex tasks

Start a ChatGPT Work or Codex chat and pick Chrome, Edge, Brave Browser, Opera, or Vivaldi from the @-mention menu. The docs’ example is “@Edge open Salesforce and update the account from these call notes.” ChatGPT can read or act on sites where you are already signed in. The docs name LinkedIn, Salesforce, Gmail, and internal tools as examples. Those are examples of signed-in sites, not partnerships.

By default ChatGPT asks before it uses each new website, based on the host. The choices are Allow once, Allow for this site, Allow for all sites, and Decline. Allow for all sites is marked elevated risk, because ChatGPT then stops asking. Allow and block lists sit under Settings, then Computer Use, then Manage, and the supported browsers share them.

The Verge says Work can “control” Chrome tabs for sending messages, filling forms, or downloading files, and can organize or group tabs. The sample queries it attributes to OpenAI are form-filling that stops before submit, copying vendors from tabs into a sheet, comparing contractor tabs and drafting an email, and filling a form in @chrome while adding a calendar appointment. The docs page does not print that list. It does say a Chrome permission prompt may include “Manage your downloads” and “View and manage your tab groups.” A separate @Browser command uses the desktop app’s built-in browser, off the regular browser profile.

Permissions, storage, and untrusted pages

At install, the browser asks you to accept permissions. The docs say Chrome’s prompt may include the page debugger, reading and changing all data on all websites, reading and changing browsing history on signed-in devices, notifications, bookmarks, downloads, communication with cooperating native applications, and tab groups. Those permissions make the workflows possible. During a task, ChatGPT still uses its own confirmations, allowlists, and blocklists before it uses a website or history.

History is marked elevated risk. It can include telemetry, internal URLs, search terms, and activity on signed-in devices. If you allow it, relevant entries can enter the task context. The docs say malicious or misleading page content can increase the risk that ChatGPT copies this data somewhere unintended. History access is requested per use, scoped to that request, with no always-allow option.

OpenAI says it does not keep a separate complete record of browser actions from the extension. It stores activity that becomes part of the chat, including page text, screenshots, tool calls, summaries, and messages. If Memories is off, browser control does not use memories. The docs say not to send secrets through these tasks unless they are required and you are there to review each prompt.

The page warns: “Treat page content as untrusted context, and review the website before allowing ChatGPT to continue.” It also says to treat webpage content, selected text, and video transcripts as untrusted, and to review the page and any permission request first.

The Register, Thomas Claburn, 15 October 2026 at 21:04 UTC, reports a separate finding from that day: in a Signals Corps sample of Common Crawl responses, 30 sites sent indirect prompt-injection text in headers, 22 of them described as pranks. That report is about other sites’ headers. It does not say this extension was compromised.