ChatGPT HTML Preview XSS Enables Account Takeover
Researchers at Parameter Labs discovered a multi-stage exploit chain against ChatGPT's HTML preview (Canvas/artifacts) feature that allowed untrusted sandboxed iframe code to escape containment, inject unsandboxed iframes, and achieve JavaScript execution on the ChatGPT origin. By abusing a MathLive postMessage handler that used innerHTML and exploiting YouTube's oEmbed endpoint to bypass CSP script restrictions, attackers could exfiltrate private user data or perform actions on behalf of any signed-in user who visited a malicious shared ChatGPT URL. OpenAI patched the vulnerability and awarded a $5,000 bug bounty, though the severity of the exploit chain arguably warranted a higher payout.