OpenAI has patched a critical ChatGPT vulnerability that could allow attackers to access private conversations by tricking users into opening a malicious shared chat link.
The flaw, discovered by cybersecurity researchers at Parameter, exploited an interaction between ChatGPT’s HTML Preview feature and a mathematical rendering component. Parameter’s research discovered that attackers could execute JavaScript within a victim’s authenticated ChatGPT session and retrieve conversations that had never been publicly shared.
The attack used legitimate ChatGPT sharing links, making malicious pages appear trustworthy. An early version required victims to click the Preview button, but researchers later developed a variant that executed automatically when the shared conversation opened.
How the ChatGPT Vulnerability Worked
The attack began with a specially prepared ChatGPT conversation containing an interactive graph and an HTML Preview. The graph loaded a mathematical library called MathLive, while the Preview provided a way to send malicious instructions to the main ChatGPT page.
Researchers discovered that MathLive accepted certain browser messages without properly verifying their origin. This allowed attacker-controlled HTML to escape the Preview’s restricted environment and create a new browser frame with access to the authenticated ChatGPT session.
The attackers then bypassed additional script restrictions using a YouTube endpoint permitted by ChatGPT’s Content Security Policy, allowing their JavaScript to run with the same privileges as the ChatGPT website.
In a controlled demonstration, Parameter used the exploit to retrieve a victim account’s recent conversation list, access a separate private chat, and transmit part of its contents to an external server. The researchers said the same access could potentially enable other actions available through ChatGPT’s authenticated web interface.
OpenAI Confirms Security Fix
Parameter reported the vulnerability to OpenAI last month and OpenAI classified the issue as P1, indicating critical priority, and confirmed that fixes were deployed across affected ChatGPT frontend versions. Affected versions of ChatGPT now reject the malicious browser messages that enabled the attack.
The researchers received a reward through OpenAI’s bug bounty program for the discovery.
There is no publicly reported evidence that attackers exploited the vulnerability against real users before it was patched. The fix was deployed on OpenAI’s servers, so users don’t need to install an update or change their passwords because of this vulnerability.
Leave a Reply