ChatGPT account takeover via sandbox escape in HTML preview
📅 October 31, 2026 • Parameter Labs Researchers at Parameter Labs have published a full walkthrough of a vulnerability chain that turned an ordinary public ChatGPT share link into attacker-controlled JavaScript running inside the signed-in session of whoever opened it. The team reported the chain
The chain combined features that looked harmless on their own. ChatGPT renders model-authored HTML in a Preview running inside a sandboxed iframe on a separate web address, and the researchers confirmed the sandbox itself held — Preview code could not read the main page. But the same conversation could also contain an interactive graph, and that graph loads MathLive, a math-input library, into the main chatgpt.com page. MathLive installs a listener for postMessage events that control its on-screen keyboard. That listener accepted messages from any sender with no origin check, treated the keyboard layout field as HTML and rendered it via innerHTML in the trusted page.
How it works in practice: the failure lived in the seam between components, not inside any single one — the sandbox held, the CSP was in place and MathLive is a legitimate library. Teams building artifact previews, chart widgets or connector UIs should audit every postMessage listener installed in their top-level page, verify both event origin and event source before accepting state-changing messages, keep dynamically created frames sandboxed along the whole rendering path, and treat any CSP allowlist entry for a third-party script endpoint as a potential execution path. For anyone shipping agent or preview features the checklist is concrete — authenticate every cross-frame message, sandbox untrusted markup end to end, and measure same-origin script impact in the victim's authenticated context.
Continue the conversation: https://t.me/AIAutomationArchitecture · Bluesky