Overview
- Parameter researchers reported the vulnerability to OpenAI on October 18, OpenAI reproduced the proof and raised its severity to P1 on October 21, and fixes that block the exploit were rolled out by October 26.
- The exploit combined ChatGPT’s HTML Preview, MathLive’s unguarded postMessage listener, an unsandboxed srcdoc iframe that inherited chatgpt.com origin, and a permissive content-security-policy that allowed a YouTube JSONP callback to run attacker JavaScript.
- When triggered, attacker code ran with the victim’s chatgpt.com privileges, called signed-in APIs to list conversations, opened a private chat not shared with the attacker, and exfiltrated conversation data.
- OpenAI’s patch rejects the cross-frame messages the attack relied on so users do not need to take action, and Parameter published a detailed writeup on October 28 with proof-of-concept details and a public audit script.
- The case illustrates a broad web-app risk: message handlers that do not check event.origin plus direct insertion of untrusted HTML; recommended fixes include validating event.origin, sanitizing or avoiding innerHTML, sandboxing srcdoc frames, tightening CSP allowlists, and running automated listener audits.