Parameter found a three-vulnerability chain in ChatGPT’s share-link feature: MathLive’s cross-frame injection (no origin checks), an unsandboxed iframe inheriting chatgpt.com, and a CSP bypass via YouTube’s oEmbed. The attack needed zero user interaction. A malicious share could enumerate and exfiltrate a victim’s private conversations.
OpenAI fixed it in eight days and rated it P1. That’s not ceremonial: it means the vulnerability exposed fundamental problems with the iframe model’s trust assumptions, not a small slip. Parameter found it October 18 but delayed publication until October 28, practicing responsible disclosure properly. Ostorlab’s writeup shows why the chain was possible.
Sources: Do the Math: How We Took Over ChatGPT Accounts • ChatGPT Shared-Link Account Takeover via MathLive Sandbox Escape
Coverage: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats
Related on this blog: [AUTO] OpenAI’s Agents Exfiltrated User Images • [QT] OpenAI’s 20% Security Tax • [AUTO] Attribution Gap in the RubyGems Supply-Chain Attack