Exploiting ChatGPT Sandbox via Cross-Frame Message Injection
Researchers bypassed ChatGPT security to execute arbitrary code via public conversation links.
1The Sandbox Escape Mechanism
In October 2026, researchers discovered a critical vulnerability allowing attackers to take over ChatGPT accounts. By bypassing content security policies, they turned public conversation shares into malicious JavaScript execution. Victims only needed to open a link, granting the attacker full access to their authenticated web session without any additional user interaction.
2Chain of Vulnerable Features
The exploit relied on two seemingly harmless features: HTML Preview and interactive graphs. While the Preview was isolated in a restricted frame, the graph loaded a math library called MathLive. This library installed a message listener on the main page, creating an unintended communication bridge between the restricted frame and ChatGPT.
3Exploiting the MathLive Listener
The MathLive listener accepted messages to update virtual keyboard layouts without verifying the sender's origin. Attackers sent messages to replace the keyboard layout with malicious HTML. Because the listener lacked origin validation, it accepted these instructions from any web address, effectively allowing the attacker to inject arbitrary content into the main page.
4Bypassing Content Security Policy
Inserting HTML via innerHTML did not immediately execute JavaScript due to strict Content Security Policy rules. The researchers bypassed this by using an unsandboxed iframe with the srcdoc attribute. This created a new document inheriting the chatgpt.com origin, allowing them to load external scripts that were permitted by the existing policy.
5Leveraging YouTube for Execution
The exploit utilized YouTube's oEmbed endpoint to execute code. Since YouTube was an allowed source in ChatGPT's CSP, the researchers used a JSONP-style callback to run their payload. By appending a void statement to the response, they neutralized error objects and successfully executed arbitrary JavaScript within the victim's authenticated ChatGPT session.
6Automated Attack Delivery
The researchers packaged the entire exploit chain into a single public conversation share. When a victim opened the link, the payload automatically triggered the MathLive message sequence. This required no installation, project membership, or developer tool usage, making the attack highly effective and simple to distribute via social media or email.
7Data Theft and API Access
Once the JavaScript executed as chatgpt.com, it gained full access to the victim's authenticated APIs. The payload enumerated recent conversations and retrieved content from private chats that were never shared. This demonstrated a practical cross-user data-theft primitive, where the attacker could read sensitive information and perform actions on the victim's behalf.
8Proof of Concept Results
The researchers confirmed the exploit by successfully reading private conversation data and sending it to an external server. The attack was stable, often executing within 4.5 seconds of opening the link. This proved that the vulnerability was not limited to UI manipulation but extended to full account compromise through authenticated API calls.
9Security Boundary Failure
The root cause was not the Preview sandbox itself, which functioned as intended. Instead, the failure occurred because a trusted component in the main page accepted instructions from an untrusted source. By combining multiple legitimate features, the researchers created a path that bypassed the security boundary, highlighting the risks of complex feature integration.
10Resolution and Patching
OpenAI classified the report as P1 and implemented a fix across two versions of the web frontend. The patch, rolled out by October 26, specifically blocked the cross-frame MathLive messages. This effectively severed the communication path between the restricted Preview and the main page, closing the vulnerability for all users.
11Technical Payload Complexity
The final exploit payload was highly optimized, involving over 7,000 characters for the iframe markup. The researchers used toString() conversions and whitespace collapsing to fit the payload into the callback parameter. This level of technical precision allowed the malicious code to bypass filters and execute reliably within the restricted browser environment.
12Lessons in Feature Integration
This incident underscores the danger of combining isolated features without strict cross-origin validation. Every individual component appeared secure, but their interaction created a critical security flaw. Developers must ensure that message listeners and API endpoints verify the origin of all incoming data, even when those features seem benign or unrelated to authentication.
Original article: Hacker News — Exploiting ChatGPT Sandbox via Cross-Frame Message Injection