We took over ChatGPT accounts: the MathLive postMessage chain, and the 20-line audit for your own listeners

8.4 relevance

Detailed account takeover via ChatGPT share links with CSP bypass is technically deep, novel, and highly actionable for security.

AI/ML dev.to

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a platform engineer, this demonstrates how a single unvalidated message listener in a third-party library can chain with sandbox and CSP misconfigurations to produce a full account takeover on the most-visited AI site, highlighting why postMessage origin checks should be part of your dependency audit pipeline.

Key Takeaways

Run a static scan for addEventListener('message') handlers missing event.origin or event.source checks across your node_modules and bundled dependencies tonight.

We took over ChatGPT accounts: the MathLive postMessage chain, and the 20-line audit for your own listeners

Summary

A chain of four unvalidated postMessage listeners in MathLive, the math-input library loaded by ChatGPT for interactive graphs, enabled full account takeover when a victim opened a shared conversation link. The exploit bypassed CSP via a YouTube JSONP endpoint and used an unsandboxed srcdoc iframe to inherit chatgpt.com's origin, allowing session token theft and conversation exfiltration in ~4.5 seconds. A 20-line static audit pattern (checking for missing event.origin/event.source checks) can flag similar vulnerabilities in any JavaScript bundle.

Author

Sam LABBE