ChatGPT Vulnerability Let Attackers Hijack User Accounts

Parameter Labs discovered a critical flaw in ChatGPT’s HTML preview feature, which renders untrusted web applications in sandboxed iframes. The vulnerability stemmed from inadequate isolation between the sandbox and the parent window, allowing attackers to escape the sandbox and access private user data.

The exploit used a chain of weaknesses. OpenAI integrates the MathLive library to support mathematical graphs, which includes a virtual keyboard triggered via cross-frame messages. The library applied innerHTML operations without verifying message sources and failed to restrict which frames could invoke it. This let attackers inject new iframes without sandbox protections. OpenAI’s content security policy blocked inline code and whitelisted only specific domains, but the YouTube oEmbed endpoint could be abused to deliver executable JavaScript that bypassed these restrictions.

After achieving JavaScript execution in the ChatGPT context, attackers could easily retrieve and exfiltrate private data. A malicious share link posed a risk to any signed-in user—enabling both data theft and unauthorized account actions. OpenAI patched the vulnerability and paid a $5,000 bounty, though security researchers argue this falls short for a flaw allowing full account compromise.