ChatGPT HTML preview vulnerability allowed account takeover

Parameter Labs discovered a complex exploit chain in ChatGPT's HTML preview feature (formerly Canvas) that allowed attackers to exfiltrate private user data and take actions on behalf of signed-in users. The vulnerability involved chaining together multiple weaknesses: the MathLive JavaScript library's virtual keyboard could be triggered via postMessage() from sandboxed iframes, that message handler used innerHTML allowing HTML injection, and YouTube's oEmbed endpoint could bypass Content Security Policy rules to execute JavaScript. OpenAI has patched the vulnerability and paid a $5,000 bug bounty.

Key points

• Attackers could create malicious ChatGPT share URLs that, when visited by signed-in users, executed unauthorized code to steal private data or take actions on their behalf
• The attack chained five components: postMessage() to trigger MathLive's virtual keyboard, innerHTML injection in the parent page, iframe sandbox escape, YouTube oEmbed CSP bypass, and API exfiltration via image references
• OpenAI's sandboxed HTML preview iframes were supposed to stay isolated, but the MathLive library's message receiver created an unintended bridge to the parent page
• While OpenAI's CSP blocked inline scripts and restricted script sources, YouTube was allowlisted and its oEmbed endpoint could reflect JavaScript back in executable form
• The vulnerability is now fixed; the $5,000 bounty amount was noted as potentially low given the severity of full account takeover capability

How to use it

• Exercise caution with ChatGPT share URLs from unknown sources, even though this specific issue is patched
• If building sandboxed preview features, avoid innerHTML in postMessage handlers and audit third-party libraries for unexpected parent-page interaction surfaces
• Maintain minimal CSP allowlists; even trusted domains like YouTube can have endpoints that reflect user input
• Test that sandbox escapes via HTML injection cannot introduce unrestricted iframes that bypass security boundaries

Have any of you encountered similar sandbox escape patterns in other AI chat tools?