ChatGPT account takeover via sandbox escape in HTML preview

#chatgpt #cybersecurity #openai #security

📅 October 31, 2026 • Parameter Labs

Researchers at Parameter Labs have published a full walkthrough of a vulnerability chain that turned an ordinary public ChatGPT share link into attacker-controlled JavaScript running inside the signed-in session of whoever opened it. The team reported the chain to OpenAI on October 18, OpenAI shipped a fix on October 26 and classified the report as P1, paying a $5,000 bug bounty that Simon Willison, in his October 31 write-up, called a bit cheap for the severity. Coverage from The Hacker News and Ostorlab landed the same day, bringing the finding to a wider audience. Any logged-in user who opened the malicious link was exposed — opening it was the only required action, with no install, no paste and no developer tools.

The chain combined features that looked harmless on their own. ChatGPT renders model-authored HTML in a Preview running inside a sandboxed iframe on a separate web address, and the researchers confirmed the sandbox itself held — Preview code could not read the main page. But the same conversation could also contain an interactive graph, and that graph loads MathLive, a math-input library, into the main chatgpt.com page. MathLive installs a listener for postMessage events that control its on-screen keyboard. That listener accepted messages from any sender with no origin check, treated the keyboard layout field as HTML and rendered it via innerHTML in the trusted page.

From there the researchers injected a new iframe through the srcdoc attribute with no sandbox attribute, so the browser gave it the chatgpt.com identity. ChatGPT's Content Security Policy blocked inline scripts but allowed YouTube, and the YouTube oEmbed endpoint reflected attacker JavaScript back in a JSONP-style response — giving full script execution on the chatgpt.com origin. Code running as chatgpt.com could call ChatGPT's authenticated APIs as the victim. The team enumerated the conversation list, read the content of a private conversation that had never been shared, and exfiltrated data to an external server via an image request.

How it works in practice: the failure lived in the seam between components, not inside any single one — the sandbox held, the CSP was in place and MathLive is a legitimate library. Teams building artifact previews, chart widgets or connector UIs should audit every postMessage listener installed in their top-level page, verify both event origin and event source before accepting state-changing messages, keep dynamically created frames sandboxed along the whole rendering path, and treat any CSP allowlist entry for a third-party script endpoint as a potential execution path. For anyone shipping agent or preview features the checklist is concrete — authenticate every cross-frame message, sandbox untrusted markup end to end, and measure same-origin script impact in the victim's authenticated context.