ChatGPT share links bypassed sandboxes through math embeds

Sharing a chat transcript looks like one of the simplest features in a web application, because a user expects to read static text and formatted code. A research write-up from Parameter Labs demonstrates how combining interactive features inside that interface can collapse browser security. By chaining an assistant HTML preview with an interactive math graph, researchers found a path to run arbitrary JavaScript in a victim's authenticated session on chatgpt.com just by sending them a public share link.

ChatGPT isolated user-generated HTML previews on a separate domain, which prevents untrusted code from reading parent cookies or conversation history. However, rendering an interactive math graph pulled in MathLive, a library that registered a window listener on the main page without checking where messages originated. The sandboxed preview passed a message through that listener to update an on-screen keyboard with raw HTML. An unsandboxed frame then adopted the chatgpt.com origin, and a legacy callback on YouTube's media endpoint allowed the attacker to bypass the site's Content Security Policy.

Because the injected code ran with the user's active session, it could enumerate private chats, read their contents, and exfiltrate the data. OpenAI patched the issue two days after disclosure, but the underlying risk remains relevant across the industry. As chat interfaces shift from basic text windows into rich runtimes rendering live graphs, apps, and previews side by side, every imported library that listens for cross-frame messages becomes an uncontrolled doorway straight into authenticated enterprise data.