ChatGPT account takeover via sandbox escape in HTML preview
📅 October 31, 2026 • Parameter Labs Researchers at Parameter Labs have published a full walkthrough of a vulnerability chain that turned an ordinary public ChatGPT share link into attacker-controlled JavaScript running inside the signed-in session of whoever opened it. The team reported the chain to OpenAI on October 18 , OpenAI shipped a fix on October 26 and classified the report as P1 ,…
On October 31, 2026, researchers from Parameter Labs disclosed a vulnerability that allowed an ordinary public ChatGPT share link to become attacker-controlled JavaScript running inside a signed-in user's session. OpenAI acknowledged the issue on October 18, released a patch on October 26, and designated it a P1 severity, offering a $5,000 bounty that Simon Willison deemed insufficient for its gravity.
The vulnerability's full disclosure coincided with coverage from The Hacker News and Ostorlab, raising awareness across the security community. Opening the malicious link was sufficient for any logged-in user to be exposed, with no additional actions required. The attack leveraged ChatGPT's HTML preview feature, running within a sandboxed iframe on a distinct web address, where the sandbox effectively blocked code execution.
However, the conversation could contain an interactive graph, which loaded MathLive, a math-input library, into the primary chatgpt.com page. MathLive sent postMessage events to control its on-screen keyboard without verifying the origin, accepting messages from any source. These messages were then interpreted as HTML and rendered using innerHTML in the trusted page.
The researchers exploited this by injecting a new iframe through the srcdoc attribute, bypassing the sandbox, and granting it the chatgpt.com identity. With Content Security Policy blocking inline scripts but permitting YouTube, the YouTube oEmbed endpoint reflected attacker JavaScript back in a JSONP-style response, granting full script execution on chatgpt.com.
From there, attackers could access the conversation list, read private conversations, and exfiltrate data via an image request. To mitigate such risks, developers should audit postMessage listeners, verify event origins and sources before processing state-changing messages, ensure sandboxed frames throughout the rendering path, and treat CSP allowlist entries for third-party scripts as potential execution paths.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
