Did the victim need to do anything besides open the link?
Security researchers found a way to turn an ordinary public ChatGPT share link into a tool for taking over another user's account. Opening the link was the only action the victim had to take. OpenAI fixed the flaw on October 26 and classified the report as P1.
How did the ChatGPT share link attack work?
The attack started with two features that looked harmless on their own. The first was ChatGPT's Preview feature, which turns an HTML code block into a small working webpage. ChatGPT runs that page in a restricted frame on a separate web address, so its code cannot directly inspect the signed-in ChatGPT page around it. The second was an interactive graph. Behind the scenes, the graph loaded a math library called MathLive, which installed a listener on the main ChatGPT page to handle messages related to its on-screen keyboard.
That listener was the weak point. Browsers allow two frames to pass messages to each other, even when they cannot read each other's pages. The receiver is supposed to check who sent the message before acting on it. The researchers found that MathLive did not run that check for one setting. Its listener accepted a message that replaced the keyboard layout, and the layout was allowed to contain raw HTML. The Preview frame, which should have been untrusted, could send that message.
Getting HTML into the page was only the first step. Script tags inserted that way do not run on their own. The researchers got around this by having the page create an embedded frame without a sandbox, which gave them a fresh document where their code could execute. ChatGPT's content security policy blocked inline JavaScript but allowed scripts from YouTube. The researchers used a YouTube oEmbed endpoint that accepted a callback parameter, which let them place their own code inside a response that the browser would load as a script. The endpoint's error message was attached after the callback, and ending the payload with a void expression kept that error from breaking the code.
Once the code was running as chatgpt.com, it had the same access as the victim's own session. The researchers said it could call ChatGPT's conversation APIs, list the victim's recent conversations and request message data from a selected private chat. The chat they accessed was unrelated to the shared link and had never been shared with the attacker. The proof-of-concept then sent a small piece of that data to a server the researchers controlled. They said the code had already received the full response, so the attack was not limited to the content they chose to send. The researchers also said that anything available through ChatGPT's authenticated web interface sat inside the same security boundary.
The first versions were less dangerous. One early test relied on a researcher-controlled ChatGPT App, which a victim would have had to connect to first. The version that mattered put the graph and the malicious Preview into a single public conversation. When another user opened the share, the payload could run automatically. In the researchers' tests, an alert appeared about 4.5 seconds after the page loaded. They reproduced the automatic path three times in a separate account, including after a hard refresh.
How did OpenAI fix the ChatGPT share link flaw?
The researchers reported the issue to OpenAI's bug bounty program on October 18. OpenAI reproduced it on October 21 and raised the severity from an initial P2 rating to P1. The fix rolled out across two versions of ChatGPT's web frontend, and the timing was not even. On October 22, OpenAI reported that one frontend was fixed while the other was still being updated. CSP changes blocked part of the chain during that gap. On October 26, OpenAI confirmed that both versions rejected the cross-frame MathLive messages, marked the issue resolved and awarded a total bounty of $5,000.
Where the design broke down
The researchers said the Preview sandbox worked as intended. The failure happened when a second component on the main page accepted instructions from the sandboxed frame without verifying the sender. The YouTube endpoint was the final workaround around the content security policy, not the root cause. Blocking that one endpoint would have closed one route to JavaScript while leaving the HTML injection path in place.
The researchers said the problem existed only in the combination of features. Preview was isolated, graphs could load a keyboard, frames could exchange messages, the policy allowed a major media provider, and public conversations could be shared. The vulnerability appeared only when all of those features met on one page. Their recommendations for developers included checking both the origin and the exact window of any message that changes state, keeping cross-window settings free of raw HTML, and keeping dynamically created documents sandboxed when an untrusted frame can influence them.
Este artigo foi escrito com a assistência de IA.
News Factory APP - notícias agênticas para impulsionar seu SEO e AEO.