ChatGPT Account Takeover Vulnerability Analysis

The Vulnerability: Cross-Site Account Takeover

In October 2026, security researchers identified a vulnerability that allowed an attacker to execute arbitrary JavaScript within the authenticated session of a ChatGPT user. By creating a specially crafted public conversation link, an attacker could force a victim's browser to perform actions on their behalf, including enumerating private conversation lists and exfiltrating sensitive chat history. The exploit required no user interaction beyond clicking a shared link, bypassing standard security boundaries through a chain of seemingly benign features.

The Exploit Chain

The vulnerability was not the result of a single flaw, but rather the interaction between four distinct components: the ChatGPT Preview feature, the MathLive math library, a cross-window messaging mechanism, and a Content Security Policy (CSP) bypass.

1. Breaking the Sandbox

ChatGPT's 'Preview' feature renders HTML code blocks in a restricted, sandboxed iframe. While this isolation prevents the preview from directly accessing the parent chatgpt.com document, the researchers discovered that the main page contained a listener for postMessage events intended for the MathLive library. Crucially, this listener accepted messages from any origin and failed to verify the sender's identity.

2. HTML Injection via MathLive

By sending a malicious message to the MathLive listener, the researchers were able to inject arbitrary HTML into the main ChatGPT document. The application used an unsafe innerHTML assignment that failed to properly sanitize the input, allowing the attacker to inject an iframe with the srcdoc attribute. Because this frame was created by the main chatgpt.com document, it inherited the parent's origin, effectively escaping the original sandbox.

3. Bypassing CSP

While the injected code was initially restricted by the site's Content Security Policy (CSP), the researchers identified that the policy permitted scripts from YouTube. By leveraging a JSONP-style callback parameter in YouTube's oEmbed endpoint, they were able to execute arbitrary JavaScript, effectively bypassing the CSP restrictions and achieving full execution in the context of the victim's session.

Impact and Remediation

Because the injected JavaScript operated within the victim's authenticated session, it possessed the same privileges as the user. This allowed the exploit to:

• Enumerate the victim's private conversation history.
• Retrieve content from private conversations that were never shared.
• Perform unauthorized actions via ChatGPT's backend APIs.

OpenAI classified this report as a P1 vulnerability and resolved the issue on October 26, 2026, by updating the frontend to properly validate message origins and sanitize inputs. The researchers were awarded a $5,000 bounty for the discovery.

Community Discussion and Insights

The disclosure sparked significant debate within the security community, particularly regarding the adequacy of the bounty and the nature of the exploit. Many commenters expressed concern that a $5,000 reward for a critical, P1-rated account takeover vulnerability is insufficient, suggesting that such low payouts might discourage responsible disclosure.

"5k makes me think the next guy is gonna sell his exploit in the black market instead." — htk

Others noted the irony of the vulnerability, pointing to the complexity of modern web applications as a primary driver for such flaws.

"This is exactly what happens as you build larger monoliths, system complexity and bug surface increases logarithmically." — usernametaken29

Some industry professionals also raised concerns about the research firm's methodology, noting that unsolicited security testing—even when well-intentioned—can be perceived as intrusive or unprofessional by organizations without established bug bounty programs.