Critical ChatGPT flaw let one malicious link access private chats; OpenAI has fixed it
- Severity
- Critical
- Sources
- 1
What happened
The chain abused a MathLive message listener on the main chatgpt.com page that accepted postMessage keyboard-layout and open-keyboard messages from the sandboxed HTML Preview without checking sender origin or source window. Attacker HTML reached innerHTML via createHTML, then an unsandboxed srcdoc iframe inherited the chatgpt.com origin. CSP allowed YouTube scripts, and a YouTube oEmbed JSONP callback provided code execution. The payload read session data, retrieved unrelated private conversations via authenticated APIs, and exfiltrated them through an image request. Parameter reported on 18 October, OpenAI raised priority on 21 October, and fixed frontends rejected the messages by 26 October. No CVE is given. Defenders should verify origin and source for cross-frame messages and keep untrusted HTML sandboxed.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- No action needed.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies