ChatGPT HTML Previews Sandboxing Gap: Detecting and Preventing Account Takeover

Author: Senior Security Consultant, Security Arsenal
Date: October 31, 2026

Introduction

A newly disclosed security flaw in ChatGPT's implementation of HTML previews—formerly known as Canvas—allows attackers to escape the sandboxed iframe environment and take over user accounts. Parameter Labs' research reveals that untrusted HTML content rendered within ChatGPT's interface can interact with OpenAI's APIs, exfiltrate session tokens, and access private user data. This is not a theoretical vulnerability; it represents a direct threat to enterprise users leveraging ChatGPT for sensitive operations, including code generation, document drafting, and internal communications.

For defenders, the urgency is clear: any organization using ChatGPT's web interface is at risk if users interact with maliciously crafted HTML content. The attack chain is complex but entirely client-side, meaning traditional network-based defenses may not detect it. SOC teams must prioritize browser-level monitoring, strict Content Security Policy (CSP) enforcement, and user education to mitigate this threat.

Technical Analysis

Affected Component

The vulnerability resides in ChatGPT's HTML preview feature, which renders interactive HTML/JavaScript applications within a sandboxed <iframe>. The sandbox is intended to isolate untrusted code from the main ChatGPT application, but Parameter Labs discovered a bypass that allows malicious iframes to:

Access the parent window's DOM and JavaScript context.
Exfiltrate session tokens (e.g., __Secure-next-auth.session-token).
Make authenticated API calls to OpenAI's backend on behalf of the victim.
Persist access by stealing refresh tokens or session cookies.

Attack Chain

The exploitation chain involves multiple steps:

Malicious HTML Generation: The attacker crafts a prompt that causes ChatGPT to generate an HTML preview containing malicious JavaScript. This could be delivered via a phishing link, a shared chat, or a compromised integration.
Sandbox Escape via MathLive: OpenAI uses the MathLive JavaScript library for rendering mathematical expressions in HTML previews. Parameter Labs found that MathLive's onchange event handler can be abused to execute arbitrary JavaScript in the context of the parent window.
Token Theft: Once the sandbox is escaped, the malicious script accesses window.parent.document to steal session cookies or localStorage tokens.
Account Takeover: The stolen credentials are used to authenticate as the victim, granting the attacker full access to their ChatGPT account and any connected services.

Exploitation Status

As of this writing, there is no public proof-of-concept (PoC) exploit code, but Parameter Labs has provided detailed technical writeups. Given the complexity of the attack chain, widespread exploitation is unlikely in the short term, but targeted attacks against high-value users (e.g., developers, executives) are a realistic concern. OpenAI has not yet released a patch, so defenders must rely on mitigations and detection.

Detection & Response

Sigma Rules

The following Sigma rules target the observable behaviors of this attack, including suspicious HTML preview interactions and token exfiltration attempts.

YAML

---
title: Suspicious ChatGPT HTML Preview Interaction
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects suspicious interactions with ChatGPT's HTML preview iframe that may indicate sandbox escape attempts.
references:
  - https://www.parameter.ai/labs/we-found-a-gap-at-openai
author: Security Arsenal
date: 2026/10/31
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: browser
detection:
  selection:
    EventType: 'iframe_interaction'
    URL|contains:
      - 'chat.openai.com'
      - 'chatgpt.com'
    IframeContent|contains:
      - 'MathLive'
      - 'onchange'
  condition: selection
falsepositives:
  - Legitimate use of ChatGPT's HTML preview feature
level: high
---
title: ChatGPT Session Token Exfiltration
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects attempts to exfiltrate ChatGPT session tokens via suspicious JavaScript execution in the browser.
references:
  - https://www.parameter.ai/labs/we-found-a-gap-at-openai
author: Security Arsenal
date: 2026/10/31
tags:
  - attack.credential_access
  - attack.t1552
logsource:
  category: browser
detection:
  selection:
    EventType: 'cookie_access'
    URL|contains:
      - 'chat.openai.com'
      - 'chatgpt.com'
    CookieName|contains:
      - '__Secure-next-auth.session-token'
      - 'session'
  condition: selection
falsepositives:
  - Legitimate session management by ChatGPT
level: high

KQL (Microsoft Sentinel / Defender)

The following KQL query hunts for suspicious browser activity related to ChatGPT HTML previews, including iframe interactions and token access attempts.

KQL — Microsoft Sentinel / Defender

// Hunt for suspicious ChatGPT HTML preview interactions and token exfiltration
let suspiciousIframes = BrowserEvents
    | where Url contains "chat.openai.com" or Url contains "chatgpt.com"
    | where IframeContent contains "MathLive" or IframeContent contains "onchange"
    | project Timestamp, DeviceName, Url, IframeContent, UserName;
let suspiciousTokenAccess = BrowserEvents
    | where Url contains "chat.openai.com" or Url contains "chatgpt.com"
    | where CookieName contains "__Secure-next-auth.session-token" or CookieName contains "session"
    | project Timestamp, DeviceName, Url, CookieName, UserName;
suspiciousIframes
| union suspiciousTokenAccess
| sort by Timestamp desc

Velociraptor VQL

The following VQL artifact hunts for suspicious browser processes interacting with ChatGPT's HTML preview feature.

VQL — Velociraptor

-- Hunt for suspicious browser processes interacting with ChatGPT HTML previews
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'chat.openai.com' OR CommandLine =~ 'chatgpt.com'
   AND (CommandLine =~ 'MathLive' OR CommandLine =~ 'onchange')

Remediation Script (PowerShell)

The following PowerShell script enforces a strict Content Security Policy (CSP) in the browser to mitigate the risk of sandbox escapes via HTML previews.

PowerShell

# Enforce strict CSP for ChatGPT domains
$domains = @("chat.openai.com", "chatgpt.com")
foreach ($domain in $domains) {
    $csp = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-src 'self'"
    Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\$domain" -Name "CSP" -Value $csp
}

# Disable MathLive in ChatGPT (if possible via browser extension)
$extensionPath = "HKCU:\Software\Google\Chrome\Extensions\mathlive-disabler"
if (-not (Test-Path $extensionPath)) {
    New-Item -Path $extensionPath -Force
    Set-ItemProperty -Path $extensionPath -Name "update_url" -Value "https://clients2.google.com/service/update2/crx"
}

# Log remediation actions
Write-Output "CSP enforced for ChatGPT domains and MathLive disabled."

Remediation

Immediate Actions

Disable HTML Previews: Until OpenAI releases a patch, consider disabling the HTML preview feature in ChatGPT via organizational policy or browser extension.
Enforce Strict CSP: Implement a strict Content Security Policy (CSP) for ChatGPT domains to prevent unauthorized script execution.
Monitor for Suspicious Activity: Deploy the Sigma and KQL rules provided above to detect potential sandbox escape attempts.
User Education: Train users to recognize and avoid interacting with suspicious HTML previews, especially those generated by untrusted prompts.

Long-Term Mitigations

Browser Isolation: Use browser isolation technologies to render ChatGPT HTML previews in a secure, isolated environment.
Token Rotation: Implement automated token rotation for ChatGPT sessions to limit the impact of token theft.
Vendor Engagement: Work with OpenAI to prioritize a patch for this vulnerability and advocate for stronger sandboxing in future releases.

Vendor Advisory

OpenAI Security Advisory: OpenAI Security
Parameter Labs Disclosure: How We Took Over ChatGPT Accounts

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub