# ChatGPT Web Frontend Cross-Frame Flaw (MathLive postMessage + srcdoc iframe + YouTube oEmbed JSONP CSP Bypass) Enables Account Hijack and Private Conversation Theft via Single Shared Link

> Parameter researchers found that a malicious ChatGPT shared conversation link could run attacker JavaScript as chatgpt.com, allowing listing and theft of a victim's private conversations. The chain abused the HTML Preview feature, an origin-unchecked MathLive postMessage listener, an unsandboxed srcdoc iframe, and a CSP bypass through YouTube's oEmbed JSONP endpoint. It was reported to OpenAI on 2026-10-18 and fixed on 2026-10-26.

- **Published:** 2026-11-02T09:42:18Z
- **Last reviewed:** 2026-11-02T09:42:18Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5042
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5042.png
- **ID:** TL-2026-5042
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8 (2 shown free below)

## Description

Parameter researchers disclosed a multi-step client-side exploit chain in the ChatGPT web frontend that turns a single shared-conversation link into script execution in the chatgpt.com origin. The sources describe no CVE and no vendor CVSS score. The sources also describe no in-the-wild exploitation, attribution or attacker infrastructure. The issue was demonstrated as a proof of concept by the researchers and was reproduced reliably, with execution roughly 4.5 seconds after the victim opened the crafted link.

Exploit chain: (1) The attacker builds a shared conversation containing an interactive graph that loads the MathLive library and an HTML Preview. The Preview runs in an isolated frame on a different domain. (2) The Preview posts two cross-frame messages to the main page: type 'mathlive#virtual-keyboard-message' with action 'update-setting', which replaces the virtual keyboard layouts with attacker-controlled HTML, then action 'show', which triggers rendering. The MathLive listener had an origin policy of 'none' and accepted a state-changing message without proving which frame sent it. (3) MathLive rendered the layout via innerHTML without sanitization (through a createHTML helper), so attacker HTML was injected into the main chatgpt.com page. (4) The injected HTML created an iframe using the srcdoc attribute with no sandbox. The srcdoc document inherited the chatgpt.com origin, defeating the isolation the Preview was meant to provide. (5) ChatGPT's CSP blocked inline script but allowed scripts from www.youtube.com. YouTube's oEmbed endpoint reflected an attacker-supplied callback parameter into the response body as executable JavaScript (for example https://www.youtube.com/oembed?callback=globalThis.__marker=31337;void), even for an invalid request, so a script tag pointing at it executed arbitrary JavaScript. (6) The payload ran as chatgpt.com with the victim's authenticated session.

Impact: the payload called authenticated backend APIs (GET /backend-api/conversations?...&limit=20&order=updated&offset=0 and GET /backend-api/conversations/<conversation-id>?num_turns=2) to list the victim's private conversations and read their content, and exfiltrated the data through image requests to an attacker-controlled server. Cross-account delivery was verified by the researchers. The source frames the result as account hijacking and private conversation theft.

Remediation: OpenAI addressed three root causes: the MathLive listener accepting a state-changing message without verifying the sending frame, raw HTML being carried in message data, and unsandboxed documents inheriting the parent origin. The fix rejects cross-frame MathLive messages across both affected frontend versions, with CSP and message-validation changes. It was deployed 2026-10-26. OpenAI rated the report P1 and paid a $5,000 bounty. No customer action is documented beyond using the patched web service.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1204.001 Malicious Link
- T1059.007 JavaScript
- T1212 Exploitation for Credential Access
- T1213 Data from Information Repositories

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**YouTube oEmbed JSONP Callback Carrying JavaScript (ChatGPT CSP Bypass) — Exploitation** (`TL-2026-5042-SPL-001`)

TL-2026-5042: detects requests to the YouTube oEmbed endpoint whose callback parameter contains JavaScript (any character outside a plain identifier) instead of a function name. This is the CSP script-src bypass in the ChatGPT cross-frame chain, where a script tag pointing at youtube.com/oembed?callback=globalThis.__marker=31337;void executes attacker code as chatgpt.com. The host is legitimate; the detection keys on the callback content, not the domain. Requires proxy logs with full URL visibility (TLS inspection).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1211, T1190, T1059.007
- **Data sources:** web_proxy:index=proxy sourcetype=zscalernss-web, CommonSecurityLog (CEF web proxy with full URL)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=proxy sourcetype="zscalernss-web" earliest=-24h url="*youtube.com/oembed*" url="*callback=*"
| eval decoded_url=urldecode(url)
| where match(decoded_url, "(?i)youtube[.]com/oembed[?]([^ ]*&)?callback=")
| eval jsonp_callback=replace(decoded_url, "^.*[?&]callback=([^&]*).*$", "\1")
| where match(jsonp_callback, "[^A-Za-z0-9_.]")
| eval poc_marker=if(match(jsonp_callback, "(?i)__marker|31337|globalThis"), 1, 0)
| stats count as hits max(poc_marker) as poc_marker min(_time) as first_seen max(_time) as last_seen values(jsonp_callback) as jsonp_callbacks values(http_referrer) as referrers by src user
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL contains "youtube.com/oembed" and RequestURL contains "callback="
| extend Callback = url_decode(extract(@"[?&]callback=([^&]*)", 1, RequestURL))
| where isnotempty(Callback) and Callback matches regex @"[^A-Za-z0-9_.]"
| extend PocMarker = Callback matches regex @"(?i)__marker|31337|globalThis"
| project TimeGenerated, SourceIP, SourceUserName, DeviceVendor, RequestURL, RequestContext, Callback, PocMarker
```

### Sigma

```yaml
title: YouTube oEmbed JSONP Callback Carrying JavaScript (ChatGPT CSP Bypass)
id: 7f3a9c10-5b2e-4d8a-9c61-2e4b7a1d0501
status: experimental
description: Detects requests to the YouTube oEmbed endpoint whose callback parameter contains JavaScript rather than a plain identifier, the CSP script-src bypass used in the TL-2026-5042 ChatGPT cross-frame exploit chain (PoC marker globalThis.__marker=31337;void).
references:
  - https://parameter.ai/labs/we-found-a-gap-at-openai
  - https://cybersecuritynews.com/chatgpt-flaw-exploited-with-one-link/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.defense-evasion
  - attack.t1211
  - attack.initial-access
  - attack.t1190
  - attack.execution
  - attack.t1059.007
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: 'youtube.com/oembed'
  callback_js:
    c-uri|re: '(?i)[?&]callback=[^&]*[^A-Za-z0-9_.&]'
  condition: selection and callback_js
falsepositives:
  - Security testing or red-team replay of the Parameter proof of concept
  - Rare third-party integrations that pass an unusual callback name containing special characters
level: high
```

**Known false positives:**

- Security researchers or red teams replaying the public Parameter PoC (callback=globalThis.__marker=31337;void)
- Legacy third-party widgets passing an unusual callback name containing special characters

**Tuning notes:** Field names follow the Splunk Add-on for Zscaler CIM mapping (src, user, url, http_referrer); adjust index/sourcetype and fields for Blue Coat, Palo Alto, Netskope or Squid. Detection needs TLS inspection so the oEmbed query string is visible. Keep the identifier test strict: the legitimate oEmbed callback is a bare function name, so any non-identifier character is anomalous. The vendor fix was deployed 2026-10-26, so expect hits mainly from PoC replay or lookalike abuse; do not block www.youtube.com.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Shared ChatGPT Link Followed by JavaScript oEmbed Callback Within 60 Seconds — Exploitation (locked: unlock with TL Creds)
- ChatGPT Exploit Chain: JavaScript oEmbed Callback, Conversation Harvest, Image Exfil — Post-Exploitation (locked: unlock with TL Creds)
- First-Seen External Hosts Receiving Image Beacons from [indicator] Origin — C2/Exfiltration (locked: unlock with TL Creds)
- [indicator] Virtual-Keyboard PostMessage or Unsandboxed srcdoc Payload in Web Request — Exploitation (locked: unlock with TL Creds)
- ChatGPT Conversation List Followed by Conversation Reads (limit=20/order=updated then num_turns=2) — Post-Exploitation (locked: unlock with TL Creds)
- ChatGPT Conversation Data Encoded in Image Request to External Host — C2/Exfiltration (locked: unlock with TL Creds)
- Bulk ChatGPT Private Conversation Read via Backend API (num_turns=2) — Post-Exploitation (locked: unlock with TL Creds)
- Oversized Image-Request Exfiltration from [indicator] Origin to External Host — C2/Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 8)

Defanged, TLP:CLEAR.

- Domain: `www[.]youtube[.]com`
- Domain: `chatgpt[.]com`

Full set of 8 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Parameter - We found a gap at OpenAI (original research)](https://parameter.ai/labs/we-found-a-gap-at-openai)
- [Cyber Security News - Critical ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One Link](https://cybersecuritynews.com/chatgpt-flaw-exploited-with-one-link/)
- [MathLive (arnog/mathlive) source repository](https://github.com/arnog/mathlive)
- [MDN - Window.postMessage() security considerations](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage)
- [MDN - HTMLIFrameElement.srcdoc](https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/srcdoc)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5042