ChatGPT share-link account takeover: the postMessage bug, and how to secure your own listeners
How a ChatGPT share link ran code as chatgpt.com through MathLive's postMessage listener, and the listener, iframe and CSP fixes for your own app.
#xss
Every article tagged #xss, across topics.