Parameter Labs discovered a complex XSS attack chain against ChatGPT's sandboxed HTML preview feature, exploiting the MathLive library's innerHTML-based postMessage handling to break out of the iframe sandbox. The attack leveraged YouTube's oEmbed endpoint to execute arbitrary JavaScript, enabling data exfiltration from signed-in users' accounts via malicious share URLs.
Background
OpenAI's ChatGPT allows users to embed interactive HTML content in sandboxed iframes called HTML previews (formerly Canvas), intended to display safe custom web apps without exposing sensitive APIs.
- Source
- Simon Willison
- Published
- Nov 1, 2026 at 07:15 AM
- Score
- 8.0 / 10