How We Took Over ChatGPT Accounts

Parameter Labs reported discovering a vulnerability in how ChatGPT renders custom HTML applications inside an isolated iframe. The issue stems from the MathLive JavaScript library, which OpenAI uses to generate graphs. MathLive includes a virtual keyboard that can be activated from the iframe via postMessage(). The code that receives that message inserts content using innerHTML, allowing any sandboxed frame to add HTML to the main document. Although innerHTML does not execute scripts directly, it facilitates the insertion of another iframe without sandbox restrictions.

OpenAI’s content‑security policies block inline scripts and only allow loading scripts from specific domains; one of those domains is YouTube. By exploiting YouTube’s oEmbed endpoint, attackers can return JavaScript that runs on the ChatGPT page. With that execution, an attacker can access a user’s private data through OpenAI’s APIs and exfiltrate it outside the environment via an image reference.

The exploit lets an attacker craft a shareable URL that, when opened by another authenticated user, extracts confidential information or performs actions on their behalf. OpenAI patched the flaw and offered a $5,000 bounty, a figure that researchers say is insufficient given the severity of the issue.

This story is significant because it illustrates how a chain of third‑party component vulnerabilities can compromise a widely used tool, underscoring the need for ongoing audits and reward programs that reflect the real risk.

Read the original article on Simon Willison

This summary is an informational synthesis produced by dataqbs.com. All rights to the original content belong to its author and the cited media outlet. We act solely as curators of technology news and claim no authorship.