Parameter Labs Discloses P1 ChatGPT Sandbox Escape Enabling Account Takeover

• Parameter Labs identified a P1 severity vulnerability in ChatGPT that allowed attackers to take over user accounts by sending a malicious public share link.
• The exploit bypassed the HTML Preview sandbox by leveraging a MathLive message listener that accepted unauthenticated HTML input, combined with a YouTube oEmbed JSONP flaw to bypass Content Security Policy (CSP) restrictions.
• Attackers could execute arbitrary JavaScript within the victim's authenticated session, allowing them to enumerate private conversations, retrieve message content, and exfiltrate data to external servers.
• OpenAI fixed the issue on October 26, 2026, after reproducing the attack and raising the severity from P2 to P1, awarding a $5,000 bounty.

Technical Mechanism

• The attack chain required a graph component to load MathLive in the main page and an HTML Preview to send malicious postMessage commands.
• MathLive's origin policy of none allowed the Preview to inject HTML into the keyboard layout, which was rendered via innerHTML without sanitization.
• An unsandboxed iframe with srcdoc inherited the chatgpt.com origin, and a YouTube oEmbed endpoint was used to execute the injected JavaScript despite CSP blocking inline scripts.

Impact and Fix

• The vulnerability allowed full access to the victim's authenticated API endpoints, including private conversation data that had never been shared with the attacker.
• OpenAI's fix involved rejecting cross-frame MathLive messages across two versions of the web frontend.
• The incident highlights the need for strict origin and source validation in postMessage handlers and ensuring dynamically created documents remain sandboxed.