Researchers at Parameter Labs discovered a sophisticated attack chain that allowed them to bypass ChatGPT's security boundaries and take over user accounts. The vulnerability centered on the 'HTML preview' feature, which displays interactive custom HTML apps in a sandboxed iframe. While these frames are designed to be isolated from the main ChatGPT page to prevent access to private data and APIs, a combination of three distinct flaws allowed untrusted code within the preview to 'escape' the sandbox and execute commands in the parent window.
This image illustrates the modified page structure used to initiate the attack chain described in the opening paragraph.
The first link in the chain involved the MathLive JavaScript library, which OpenAI uses for graph support. This library installed a listener on the main ChatGPT page to handle messages for its on-screen virtual keyboard. Because the listener did not verify the origin of incoming `postMessage()` calls, it accepted commands from any source, including the sandboxed HTML preview. An attacker could send a message to this listener to update the keyboard layout with custom HTML. When the keyboard was triggered, the main page used `innerHTML` to render this layout. Because `innerHTML` does not execute script tags directly, the researchers used a second technique: injecting a new `<iframe>` with a `srcdoc` attribute. This new frame was created by the main page without sandbox restrictions, giving it the same web identity as `chatgpt.com` and allowing it to access the parent page's data.
The final hurdle was ChatGPT's Content Security Policy (CSP), which blocks inline scripts but allowed scripts from a handful of domains, including YouTube. The researchers bypassed this by using YouTube's oEmbed endpoint, which supported JSONP-style callbacks. By crafting a specific callback, they could force the browser to load and execute arbitrary JavaScript from a trusted domain. Once the researchers achieved JavaScript execution within the victim's authenticated session, they could fetch private conversation lists, retrieve content from non-shared private chats, and exfiltrate that data to an external server. OpenAI addressed the vulnerability on October 26, 2026, and issued a $5,000 bug bounty for the discovery. While the fix is confirmed, the specific technical adjustments made to the MathLive integration or the CSP rules remain undisclosed in the report.
This image provides a visual proof of the final stage of the attack where private data is sent to an external server.