Researchers Discover Complex Attack Chain for ChatGPT Account Takeover
Parameter Labs uncovered a vulnerability that allowed attackers to execute JavaScript and take over ChatGPT accounts by exploiting MathLive's virtual keyboard handling within sandboxed HTML previews. This flaw highlights the immense security challenges of safely rendering interactive third-party HTML and custom apps inside modern AI interfaces without risking user data exposure. The attack chained a missing origin validation in postMessage handlers, an innerHTML injection to bypass sandbox restrictions, and a YouTube oEmbed endpoint bypass to execute scripts despite strict CSP rules.
## BACKGROUND
Sandboxed iframes isolate untrusted web content to prevent it from accessing sensitive parent page data, while postMessage is a mechanism for safely enabling cross-origin communication between these frames. Content Security Policy (CSP) acts as an added layer of defense by restricting the domains from which scripts can be loaded and executed.