# Exploiting ChatGPT Sandbox via Cross-Frame Message Injection Researchers bypassed security policies to execute arbitrary code within authenticated user sessions. - **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91) - **Published:** 2026-10-31 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/36746ca0-79e6-48b2-baec-b72ae0398441 ## The Sandbox Escape Mechanism Researchers discovered a critical vulnerability allowing attackers to bypass ChatGPT's sandbox. By sending a malicious link, an attacker could execute arbitrary JavaScript within a victim's authenticated session. The exploit chain leveraged public conversation sharing to trigger code execution, effectively granting the attacker full control over the victim's account without requiring any user installation. ## Exploiting MathLive Message Listeners The attack originated from a flaw in the MathLive library integration. A listener in the main ChatGPT page accepted messages to update virtual keyboard layouts without verifying the sender's origin. By sending a crafted message, the attacker could inject HTML into the main page, creating a path across the established security sandbox. ## Bypassing Content Security Policy While the initial injection was successful, ChatGPT's Content Security Policy initially blocked inline scripts. The researchers bypassed this by utilizing YouTube's oEmbed endpoint. By crafting a specific JSONP-style callback, they forced the browser to load and execute their payload as a trusted script, successfully running arbitrary code within the chatgpt.com origin. ## The Role of srcdoc Iframes The exploit utilized the srcdoc attribute to create an unsandboxed iframe within the main document. Because this frame was created by the main ChatGPT page, the browser assigned it the chatgpt.com identity. This allowed the injected code to bypass isolation and interact directly with the parent page's authenticated session and APIs. ## Executing Authenticated API Requests Once the JavaScript was running as chatgpt.com, it gained access to the victim's authenticated context. The payload could enumerate recent conversation lists and retrieve content from private chats that were never shared. This was not simple screen scraping, but direct interaction with backend APIs, enabling full account takeover and data exfiltration. ## Public Share Attack Vector The entire exploit was packaged into a single public ChatGPT share link. When a victim opened this link, the malicious conversation automatically triggered the payload. The process required no user interaction beyond visiting the URL, making it a highly effective method for delivering the attack through emails, social posts, or support tickets. ## Race Conditions and Reliability The exploit relied on a race condition between the graph loading and the MathLive listener initialization. To ensure reliability, the payload repeatedly sent messages for a limited period. This ensured that even if the page components loaded independently, the malicious code would eventually execute successfully, typically within 4.5 seconds of opening the link. ## Data Exfiltration Techniques After retrieving private conversation data, the payload sent the stolen information to an attacker-controlled server. It performed this by creating an ordinary image request, embedding the data within the request parameters. This allowed the attacker to exfiltrate sensitive user information silently while maintaining the appearance of a normal web session. ## Trusted Types and Sanitization The investigation revealed that the createHTML helper function acted as an identity wrapper rather than a sanitizer. It marked attacker-controlled strings as trusted, allowing the malicious HTML to be assigned to innerHTML. This design failure was a critical link in the chain, enabling the injection of the iframe that carried the payload. ## OpenAI's P1 Resolution OpenAI classified the report as a P1 vulnerability and implemented a fix by October 26. The remediation involved updating the frontend to reject cross-frame MathLive messages and tightening the origin validation policies. These changes effectively closed the path that allowed untrusted components to communicate with the main ChatGPT application window. ## Complexity of Modern Web Security This vulnerability highlights how individual secure features can create an insecure system when combined. The Preview sandbox, MathLive keyboard, and YouTube CSP were all reasonable features in isolation. However, their interaction created a complex attack surface that allowed for a full sandbox escape, demonstrating the difficulty of maintaining security in modular applications. ## Implications for Future Development The incident underscores the necessity of strict origin validation for all cross-frame communication. Developers must ensure that message listeners verify the source of every incoming request. Relying on existing security boundaries is insufficient if internal components can be coerced into performing unauthorized actions on behalf of the user, as demonstrated by this exploit. ## Sources covering this story - https://www.parameter.ai/labs/we-found-a-gap-at-openai — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._