ChatGPT Web Frontend Cross-Frame Flaw (MathLive postMessage + srcdoc iframe + YouTube oEmbed JSONP CSP Bypass) Enables Account Hijack and Private Conversation Theft via Single Shared Link

Key facts for ChatGPT shared link hijack

Detection coverage for ChatGPT shared link hijack

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5042 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: YouTube oEmbed JSONP Callback Carrying JavaScript (ChatGPT CSP Bypass) — Exploitation

TL-2026-5042: detects requests to the YouTube oEmbed endpoint whose callback parameter contains JavaScript (any character outside a plain identifier) instead of a function name. This is the CSP script-src bypass in the ChatGPT cross-frame chain, where a script tag pointing at youtube.com/oembed?callback=globalThis.__marker=31337;void executes attacker code as chatgpt.com. The host is legitimate; the detection keys on the callback content, not the domain. Requires proxy logs with full URL visibility (TLS inspection).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1211, T1190, T1059.007
• Data sources: web_proxy:index=proxy sourcetype=zscalernss-web, CommonSecurityLog (CEF web proxy with full URL)
• Severity: high
• Confidence: high

Splunk SPL

index=proxy sourcetype="zscalernss-web" earliest=-24h url="*youtube.com/oembed*" url="*callback=*"
| eval decoded_url=urldecode(url)
| where match(decoded_url, "(?i)youtube[.]com/oembed[?]([^ ]*&)?callback=")
| eval jsonp_callback=replace(decoded_url, "^.*[?&]callback=([^&]*).*$", "\1")
| where match(jsonp_callback, "[^A-Za-z0-9_.]")
| eval poc_marker=if(match(jsonp_callback, "(?i)__marker|31337|globalThis"), 1, 0)
| stats count as hits max(poc_marker) as poc_marker min(_time) as first_seen max(_time) as last_seen values(jsonp_callback) as jsonp_callbacks values(http_referrer) as referrers by src user
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL contains "youtube.com/oembed" and RequestURL contains "callback="
| extend Callback = url_decode(extract(@"[?&]callback=([^&]*)", 1, RequestURL))
| where isnotempty(Callback) and Callback matches regex @"[^A-Za-z0-9_.]"
| extend PocMarker = Callback matches regex @"(?i)__marker|31337|globalThis"
| project TimeGenerated, SourceIP, SourceUserName, DeviceVendor, RequestURL, RequestContext, Callback, PocMarker

Sigma

title: YouTube oEmbed JSONP Callback Carrying JavaScript (ChatGPT CSP Bypass)
id: 7f3a9c10-5b2e-4d8a-9c61-2e4b7a1d0501
status: experimental
description: Detects requests to the YouTube oEmbed endpoint whose callback parameter contains JavaScript rather than a plain identifier, the CSP script-src bypass used in the TL-2026-5042 ChatGPT cross-frame exploit chain (PoC marker globalThis.__marker=31337;void).
references:
  - https://parameter.ai/labs/we-found-a-gap-at-openai
  - https://cybersecuritynews.com/chatgpt-flaw-exploited-with-one-link/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.defense-evasion
  - attack.t1211
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.007
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: 'youtube.com/oembed'
  callback_js:
    c-uri|re: '(?i)[?&]callback=[^&]*[^A-Za-z0-9_.&]'
  condition: selection and callback_js
falsepositives:
  - Security testing or red-team replay of the Parameter proof of concept
  - Rare third-party integrations that pass an unusual callback name containing special characters
level: high

Known false positives:

• Security researchers or red teams replaying the public Parameter PoC (callback=globalThis.__marker=31337;void)
• Legacy third-party widgets passing an unusual callback name containing special characters

Tuning notes: Field names follow the Splunk Add-on for Zscaler CIM mapping (src, user, url, http_referrer); adjust index/sourcetype and fields for Blue Coat, Palo Alto, Netskope or Squid. Detection needs TLS inspection so the oEmbed query string is visible. Keep the identifier test strict: the legitimate oEmbed callback is a bare function name, so any non-identifier character is anomalous. The vendor fix was deployed 2026-10-26, so expect hits mainly from PoC replay or lookalike abuse; do not block www.youtube.com.

• 🔒 Shared ChatGPT Link Followed by JavaScript oEmbed Callback Within 60 Seconds — Exploitation · unlock with TL Creds
• 🔒 ChatGPT Exploit Chain: JavaScript oEmbed Callback, Conversation Harvest, Image Exfil — Post-Exploitation · unlock with TL Creds
• 🔒 First-Seen External Hosts Receiving Image Beacons from [indicator] Origin — C2/Exfiltration · unlock with TL Creds
• 🔒 [indicator] Virtual-Keyboard PostMessage or Unsandboxed srcdoc Payload in Web Request — Exploitation · unlock with TL Creds
• 🔒 ChatGPT Conversation List Followed by Conversation Reads (limit=20/order=updated then num_turns=2) — Post-Exploitation · unlock with TL Creds
• 🔒 ChatGPT Conversation Data Encoded in Image Request to External Host — C2/Exfiltration · unlock with TL Creds
• 🔒 Bulk ChatGPT Private Conversation Read via Backend API (num_turns=2) — Post-Exploitation · unlock with TL Creds
• 🔒 Oversized Image-Request Exfiltration from [indicator] Origin to External Host — C2/Exfiltration · unlock with TL Creds

Indicators of compromise for ChatGPT shared link hijack

As of 2026-11-02, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5042.

Sample indicators (2 of 8)

• Domain: www[.]youtube[.]com
• Domain: chatgpt[.]com

Defanged, TLP:CLEAR. Full set of 8 indicators: unlock with TL Creds.

How ChatGPT shared link hijack works

It was reported to OpenAI on 2026-10-18 and fixed on 2026-10-26.

Parameter researchers disclosed a multi-step client-side exploit chain in the ChatGPT web frontend that turns a single shared-conversation link into script execution in the chatgpt.com origin. The sources describe no CVE and no vendor CVSS score. The sources also describe no in-the-wild exploitation, attribution or attacker infrastructure. The issue was demonstrated as a proof of concept by the researchers and was reproduced reliably, with execution roughly 4.5 seconds after the victim opened the crafted link.

Exploit chain: (1) The attacker builds a shared conversation containing an interactive graph that loads the MathLive library and an HTML Preview. The Preview runs in an isolated frame on a different domain. (2) The Preview posts two cross-frame messages to the main page: type 'mathlive#virtual-keyboard-message' with action 'update-setting', which replaces the virtual keyboard layouts with attacker-controlled HTML, then action 'show', which triggers rendering. The MathLive listener had an origin policy of 'none' and accepted a state-changing message without proving which frame sent it. (3) MathLive rendered the layout via innerHTML without sanitization (through a createHTML helper), so attacker HTML was injected into the main chatgpt.com page. (4) The injected HTML created an iframe using the srcdoc attribute with no sandbox. The srcdoc document inherited the chatgpt.com origin, defeating the isolation the Preview was meant to provide. (5) ChatGPT's CSP blocked inline script but allowed scripts from www.youtube.com. YouTube's oEmbed endpoint reflected an attacker-supplied callback parameter into the response body as executable JavaScript (for example https://www.youtube.com/oembed?callback=globalThis.__marker=31337;void), even for an invalid request, so a script tag pointing at it executed arbitrary JavaScript. (6) The payload ran as chatgpt.com with the victim's authenticated session.

Impact: the payload called authenticated backend APIs (GET /backend-api/conversations?...&limit=20&order=updated&offset=0 and GET /backend-api/conversations/<conversation-id>?num_turns=2) to list the victim's private conversations and read their content, and exfiltrated the data through image requests to an attacker-controlled server. Cross-account delivery was verified by the researchers. The source frames the result as account hijacking and private conversation theft.

Remediation: OpenAI addressed three root causes: the MathLive listener accepting a state-changing message without verifying the sending frame, raw HTML being carried in message data, and unsandboxed documents inheriting the parent origin. The fix rejects cross-frame MathLive messages across both affected frontend versions, with CSP and message-validation changes. It was deployed 2026-10-26. OpenAI rated the report P1 and paid a $5,000 bounty. No customer action is documented beyond using the patched web service.

MITRE ATT&CK techniques by tactic:

Execution

T1059.007 JavaScript; T1204.001 Malicious Link

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1212 Exploitation for Credential Access

Collection

T1213 Data from Information Repositories

Remediation for ChatGPT shared link hijack

Patches

• OpenAI server-side frontend fix deployed 2026-10-26 rejecting cross-frame MathLive messages in both affected frontend versions

Immediate actions

• No customer action is required for the fix; OpenAI deployed it server-side on 2026-10-26
• Treat unexpected shared ChatGPT conversation links as untrusted until the sender is verified
• Review proxy or egress logs for image requests to unfamiliar hosts originating from chatgpt.com sessions around shared-link visits

Workarounds

• Avoid opening shared ChatGPT conversation links from untrusted sources while unpatched; none is needed now that the fix is deployed

Longer-term hardening

• Validate event.source and event.origin in every postMessage listener
• Never render message-supplied data through innerHTML; sanitize or use Trusted Types
• Avoid allowlisting third-party hosts that serve JSONP or reflected-callback endpoints in CSP script-src
• Sandbox srcdoc iframes and avoid putting raw HTML in cross-frame message data

Affected and fixed versions

• OpenAI — ChatGPT web frontend (chatgpt.com), shared conversations with HTML Preview and MathLive graph
  Vulnerable versions: Both ChatGPT web frontend versions identified by Parameter, prior to 2026-10-26
  Fixed in: Server-side fix deployed 2026-10-26
• MathLive — MathLive virtual keyboard message listener as integrated in ChatGPT
  Vulnerable versions: Integration accepting cross-frame mathlive#virtual-keyboard-message without sender verification
  Fixed in: OpenAI integration rejects cross-frame MathLive messages

Timeline of ChatGPT shared link hijack

• 2026-10-13 locked-ioc-7 confirmed the MathLive-to-HTML injection path in the ChatGPT web frontend.
• 2026-10-14 locked-ioc-7 achieved JavaScript execution through the UI.
• 2026-10-16 Cross-account delivery was verified (2026-10-16 to 2026-10-17).
• 2026-10-18 locked-ioc-7 reported the issue to OpenAI.
• 2026-10-21 OpenAI reproduced the issue and escalated it to P1.
• 2026-10-26 OpenAI deployed a fix rejecting cross-frame locked-ioc-8 messages in both affected frontend versions; $5,000 bounty awarded.
• 2026-10-28 locked-ioc-7 published its technical write-up 'We found a gap at OpenAI'.
• 2026-11-02 Cyber Security News published coverage of the flaw.

Sources cited for ChatGPT shared link hijack

• Parameter - We found a gap at OpenAI (original research) parameter.ai · Research · 2026-10-28
• MDN - Window.postMessage() security considerations developer.mozilla.org · Research
• MDN - HTMLIFrameElement.srcdoc developer.mozilla.org · Research
• MathLive (arnog/mathlive) source repository GitHub · Code repository
• Cyber Security News - Critical ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One Link cybersecuritynews.com · News · 2026-11-02

More in vulnerability

• TightVNC Viewer 2.8.88 x64 Pre-Authentication RCE via RFB Framebuffer Integer Overflow / Heap Buffer Overflow (No CVE) - PoC Released
• Active Exploitation of BTCPay Server Instances Draining Bitcoin Hot Wallets (Versions Older Than 2.4.2)
• Amazon Kiro IDE Prompt Injection Enabling Data Exfiltration via Malicious Workspace (CVE-2026-89332)
• Microsoft Edge Logic-Bug Full Chain: UXSS, Immersive Reader File Write and protocols.json Hijack Escape Sandbox to Windows Code Execution (Pwn2Own Berlin 2026)
• Microsoft Edge Logic-Bug Full Exploit Chain Enables Code Execution Without Memory Corruption (Pwn2Own Berlin 2026, Orange Tsai; CVE-2026-45495)