Parameter Labs discovered a multi-step vulnerability in ChatGPT’s HTML previews (the artifacts pattern, previously called “Canvas”) that allowed a sandboxed iframe to escalate privileges and execute JavaScript in the parent page. OpenAI patched the issue and paid a $5,000 bug bounty.
What was affected
- The issue involved OpenAI’s implementation of interactive custom HTML apps displayed as sandboxed iframes in ChatGPT’s HTML previews.
- The MathLive JavaScript library, used by OpenAI for graph support, includes its own virtual keyboard that can be triggered on the parent page via postMessage() from a sandboxed iframe.
- The parent page’s message-receiving code used innerHTML to insert message content, which meant any sender could add arbitrary HTML into the parent context.
How this led to code execution and data exfiltration
- While innerHTML does not directly execute script elements, it can be used to inject a new iframe that lacks sandbox restrictions.
- OpenAI’s Content Security Policy (CSP) blocked inline scripts and permitted scripts only from a small set of domains; YouTube was among the allowed sources.
- The YouTube oEmbed endpoint could be abused to reflect JavaScript in a way that executed in the page’s context. Chaining this with the innerHTML insertion allowed an attacker to run JavaScript on the ChatGPT page.
- Once JavaScript execution was achieved, the exploit could fetch private user data from APIs and exfiltrate it, for example via an image reference.
Impact
An attacker could craft a ChatGPT share URL that, when opened by another signed-in user, would exfiltrate that user’s private data or perform actions on their behalf.
Response and bounty
OpenAI fixed the vulnerability after it was reported and awarded Parameter Labs a $5,000 bug bounty. The incident was also discussed on Hacker News.
Why this matters
The exploit shows how multiple benign mechanisms—postMessage communication, innerHTML insertion, and third-party oEmbed reflections—can be chained to bypass sandboxing and CSP protections. It highlights the need for careful restriction and validation of cross-frame messages and embedded content to prevent similar attacks.
