Parameter Labs discovered a method to access private user data on ChatGPT by exploiting a gap in how OpenAI handles interactive HTML previews. The vulnerability stemmed from the MathLive JavaScript library, which powers graph support within the platform. This library includes a virtual keyboard that accepts commands via postMessage from sandboxed iframes. The receiving code in the parent page used innerHTML to process these messages, allowing untrusted code to inject new iframes without the standard security restrictions.
OpenAI’s content security policy blocked inline scripts but permitted loading resources from specific domains, including YouTube. Attackers could use the YouTube oEmbed endpoint to reflect JavaScript back into the page, bypassing the block and gaining execution privileges. Once inside, the exploit allowed the fetching of private user data from APIs and its exfiltration through an image reference. The flaw enabled the creation of share URLs that, when opened by another signed-in user, could steal their information or perform actions on their behalf. OpenAI patched the issue and paid a $5,000 bug bounty, a sum Parameter Labs considered low for the severity of the breach.
* The attack chain relied on the MathLive library’s virtual keyboard accepting postMessage commands.
* YouTube’s oEmbed endpoint was used to bypass Content Security Policy restrictions.
* Exfiltrated data was hidden within the reference of an image uploaded by the victim.
