Oleksandr Kuzmenko, EditorPublished 7 min readAI-assisted · editor-reviewed
TL;DR
- Unvalidated postMessage listeners in top-level origins can completely neutralize iframe sandbox isolation.
- Allowlisting third-party domains in Content Security Policies introduces bypass risks if external endpoints support JSONP callbacks.
- A single shared conversation URL was sufficient to achieve arbitrary API execution without user interaction beyond opening the link.
The postMessage Sandbox Breach
ChatGPT relies on domain isolation to restrict arbitrary code rendered inside its assistant HTML Preview panes. Researchers uncovered that rendering an interactive mathematical graph initialized MathLive, an open-source virtual keyboard and formula library. In doing so, MathLive registered a global window message listener in the top-level chatgpt.com document to handle mathlive#virtual-keyboard-message events.
The listener implemented an origin policy of none, processing incoming events indiscriminately from any origin without checking event.origin or confirming if the caller originated from an approved window frame. When instructed to update the virtual keyboard layout, MathLive concatenated untrusted markup directly into innerHTML on the authenticated host page.
Bypassing Content Security Policy via oEmbed JSONP
Direct innerHTML script execution is blocked by modern browser engines, but injecting an <iframe> tag configured with a srcdoc attribute created an unsandboxed child document belonging to https://chatgpt.com. While ChatGPT enforced a strict Content Security Policy (CSP) forbidding inline JavaScript, the policy explicitly allowlisted scripts from youtube.com.
The researchers leveraged YouTube's /oembed endpoint, which supported JSONP callbacks. Appending ;void to the callback parameter bypassed syntax rejection and caused the browser to execute the returned script block in the context of the victim's session. The payload successfully enumerated the user's private chat history and exfiltrated private conversation content to an external server. OpenAI patched the vulnerability on October 26 after assigning it a P1 priority rating.
When to use
- Auditing cross-origin postMessage communication patterns between web applications and embedded sandboxes.
- Designing CSP directives that prevent callback injection and JSONP-based execution.