Severe Account Takeover Vulnerability Patched in ChatGPT Artifacts (HTML Previews)

What changed?

Researchers at Parameter Labs discovered and disclosed a complex vulnerability in OpenAI's ChatGPT, specifically in the implementation of HTML previews (previously "artifacts" or "Canvas"). Malicious actors could craft a ChatGPT share URL that, when visited by a signed-in user, would execute JavaScript in the context of ChatGPT, exfiltrate private data, or act on behalf of the victim. The exploit leveraged a chain involving sandboxed iframes, the MathLive JavaScript library's virtual keyboard, the use of postMessage and innerHTML vulnerabilities, and a CSP bypass using YouTube's oEmbed endpoint. OpenAI has closed this vulnerability and paid a $5,000 bug bounty.

Why does it matter to an everyday developer?

This incident demonstrates the real-world risks involved in handling untrusted HTML and embedding third-party libraries in web applications, especially when creating interactive components with iframe sandboxes. Even with well-established protections like Content Security Policy and sandbox attributes, subtle misconfigurations and oversights can allow critical vulnerabilities such as account takeover and data exfiltration. Developers working on applications that handle user-generated content or embed third-party components should carefully audit how sandboxing, message passing, and dynamic HTML insertion interact.

What can the developer do now?

• Review all uses of sandboxed iframes, especially those displaying untrusted or user-contributed HTML.
• Audit any uses of postMessage and corresponding message receivers to restrict origins and payload types.
• Avoid using innerHTML for dynamic content insertion, or strictly sanitize inputs if unavoidable.
• Examine your Content Security Policy for unintentional script sources, especially any that could be abused for script injection or reflection.