/
← Voltar ao feed
high technology

Hacktron chains forums.openai.com postMessage XSS with exposed Mojo IPC in OpenAI ChatGPT Atlas to steal OAuth tokens

1 fonte(s) · 1 atualização(ões) · publicado 01/12/2025 21:00 · coletado há 1 dia

Researchers at Hacktron disclosed a vulnerability chain in OpenAI's ChatGPT Atlas Chromium-based AI browser that lets an attacker monitor all open tabs and capture OAuth authorization codes for any site, effectively breaking the same-origin policy. Atlas exposes Mojo IPC bindings to all *.chatgpt.com and *.openai.com origins, so a single XSS on any of those domains grants access to privileged browser-control interfaces. The researchers found a postMessage-based XSS on forums.openai.com and used a login CSRF to satisfy the authenticated-page requirement. They then used the kaur1br5.list_tabs tool to leak navigation URLs in real time. The PoC captured a GitHub OAuth code tied to the ChatGPT GitHub connector, and the same technique would apply to Reddit, Facebook and other OAuth providers. The article does not state whether OpenAI has fixed the issues, and no CVE is assigned. The researchers say they filed a report.

Technical Details

  • Root cause: an overly permissive allowlist exposes Mojo message pipes and bindings (for example web.bridge.LinkHandler and web.bridge.LocalToolHandler) to all *.chatgpt.com and *.openai.com origins. Normally only Chrome internal pages such as chrome://downloads have Mojo access.
  • Entry point: the forums.openai.com message listener handles the pushUrl action by passing the url value unsanitized to a sink, so a javascript: URL gives XSS via postMessage. The listener is active only on authenticated pages, and a login CSRF vulnerability on the site was used to get around this.
  • Escalation: the XSS page reaches the browser process through Mojo and calls callLocalTool for kaur1br5.* tools such as open_tabs, navigate_current_tab and list_tabs. handleLink can also open internal pages such as atlas://downloads.
  • Impact: looping list_tabs leaks every URL opened in the browser. A GitHub OAuth flow started from the PoC exposes the authorization code, which enables account takeover and access to the victim's repositories.
  • Failed escalation paths: javascript: bookmarks, javascript: URIs in tab navigation, and RCE via handleLink/NSWorkspace.openURL were blocked, because file:// URLs are treated as internal. Launching the agent to exfiltrate victim emails also failed.
  • This is the second AI browser the team has examined after a Universal XSS in Perplexity's Comet, and both had overly permissive allowlists exposing powerful APIs.

Remediation

  • The article gives no vendor patch details. The implied fix is to restrict Mojo exposure to a minimal set of trusted origins and to remove the XSS and login CSRF on forums.openai.com.
  • Users should treat newly released AI browsers with caution until their privileged agent interfaces are hardened.

Linha do tempo

  1. hacktron.ai ↗ · pub. 01/12/2025 21:00 · coletado 19/10 18:03 primeiro registro

    Hacktron chains forums.openai.com postMessage XSS with exposed Mojo IPC in OpenAI ChatGPT Atlas to steal OAuth tokens

    ler a análise desta fonte

    Researchers at Hacktron disclosed a vulnerability chain in OpenAI's ChatGPT Atlas Chromium-based AI browser that lets an attacker monitor all open tabs and capture OAuth authorization codes for any site, effectively breaking the same-origin policy. Atlas exposes Mojo IPC bindings to all *.chatgpt.com and *.openai.com origins, so a single XSS on any of those domains grants access to privileged browser-control interfaces. The researchers found a postMessage-based XSS on forums.openai.com and used a login CSRF to satisfy the authenticated-page requirement. They then used the kaur1br5.list_tabs tool to leak navigation URLs in real time. The PoC captured a GitHub OAuth code tied to the ChatGPT GitHub connector, and the same technique would apply to Reddit, Facebook and other OAuth providers. The article does not state whether OpenAI has fixed the issues, and no CVE is assigned. The researchers say they filed a report.

    Technical Details

    • Root cause: an overly permissive allowlist exposes Mojo message pipes and bindings (for example web.bridge.LinkHandler and web.bridge.LocalToolHandler) to all *.chatgpt.com and *.openai.com origins. Normally only Chrome internal pages such as chrome://downloads have Mojo access.
    • Entry point: the forums.openai.com message listener handles the pushUrl action by passing the url value unsanitized to a sink, so a javascript: URL gives XSS via postMessage. The listener is active only on authenticated pages, and a login CSRF vulnerability on the site was used to get around this.
    • Escalation: the XSS page reaches the browser process through Mojo and calls callLocalTool for kaur1br5.* tools such as open_tabs, navigate_current_tab and list_tabs. handleLink can also open internal pages such as atlas://downloads.
    • Impact: looping list_tabs leaks every URL opened in the browser. A GitHub OAuth flow started from the PoC exposes the authorization code, which enables account takeover and access to the victim's repositories.
    • Failed escalation paths: javascript: bookmarks, javascript: URIs in tab navigation, and RCE via handleLink/NSWorkspace.openURL were blocked, because file:// URLs are treated as internal. Launching the agent to exfiltrate victim emails also failed.
    • This is the second AI browser the team has examined after a Universal XSS in Perplexity's Comet, and both had overly permissive allowlists exposing powerful APIs.

    Remediation

    • The article gives no vendor patch details. The implied fix is to restrict Mojo exposure to a minimal set of trusted origins and to remove the XSS and login CSRF on forums.openai.com.
    • Users should treat newly released AI browsers with caution until their privileged agent interfaces are hardened.