Parameter: Do the Math, ChatGPT shared-link origin compromise

Evidence record

Researcher report of an HTML Preview and MathLive message chain with private conversation read and confirmed October 26 fix.

Read the original source ↗

Claim-level citations (3)

• supportsA shared ChatGPT conversation escaped Preview isolation and read private chats: Parameter reports using a YouTube oEmbed JSONP callback allowed by the page Content Security Policy to execute script in an unsandboxed srcdoc frame, then says OpenAI confirmed on October 26 that both frontend variants rejected the reported cross-frame MathLive messages.

  Technical walkthrough: Bypassing CSP with YouTube JSONP; What went wrong and what OpenAI fixed; Timeline, October 22-26

• supportsA shared ChatGPT conversation escaped Preview isolation and read private chats: Parameter reports a demonstrated attack in which opening an attacker-controlled shared ChatGPT conversation led to script execution in the signed-in chatgpt.com origin and allowed the researchers to retrieve an unrelated private conversation.

  Parameter, Do the Math, introduction, HTML Preview, MathLive and private conversation access sections, October 26 fix

• supportsA shared ChatGPT conversation escaped Preview isolation and read private chats: Parameter reports that untrusted HTML Preview code used MathLive keyboard postMessage update-setting and show messages to inject unsanitized layout HTML into the authenticated ChatGPT document; a subsequent iframe srcdoc path gave code the authenticated origin.

  Technical walkthrough: It started with a graph and a Preview; The message that should not have worked; iframe srcdoc execution