Checked fact 33181 Nov 2026Safety and security

Parameter says the listener accepted keyboard-layout data containing HTML that was inserted into the page with innerHTML, and that the injected HTML created an iframe with srcdoc and no sandbox attribute, which inherited the chatgpt.com identity.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

assigned the attacker-supplied keyboard layout to the real ChatGPT page through innerHTML ... inserted without a sandbox attribute ... inherited the chatgpt.com origin

What the source said when we opened it, on 1 Nov 2026.

The source

We found a gap at OpenAI
Parameter Labs · 2026-10-28

Open the source archived copy

Checked

Checked by the notis newsroom on 1 Nov 2026, against the source above.

In the story

Shared ChatGPT link could run attacker code in viewer's session, Parameter Labs says 1 Nov 2026

Cite this fact

Short permanent address

In a sentence

“Parameter says the listener accepted keyboard-layout data containing HTML that was inserted into the page with innerHTML, and that the injected HTML created an iframe with srcdoc and no sandbox attribute, which inherited the chatgpt.com identity.” ai notis, checked 1 Nov 2026. Source: We found a gap at OpenAI (Parameter Labs). https://ainotis.com/c/3318

As a reference (APA style)

ai notis. (2026, November 1). Parameter says the listener accepted keyboard-layout data containing HTML that was inserted into the page with innerHTML, and that the injected HTML created an iframe with srcdoc and no sandbox attribute, which inherited the chatgpt.com identity [Checked claim 3318]. ai notis. https://ainotis.com/c/3318

Anyone may quote this address. It does not change; if we correct the story, this page says so.