Skip to content
audiotale.net
Sign in
NewsNews

ChatGPT shared-link flaw let attacker code run in your session, Parameter says; OpenAI fixed it

Parameter says opening a malicious ChatGPT share link could run JavaScript as chatgpt.com and read private chats; OpenAI fixed it on 26 October and paid $5,000.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How it works
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Security firm Parameter says a public ChatGPT share link could run an attacker's JavaScript inside the signed-in session of anyone who opened it, long enough to list their conversations and read a private one. According to Parameter, OpenAI fixed the flaw on 26 October 2026 and paid a $5,000 bounty. Nothing needs to be installed or reset: the fix is on OpenAI's servers. The write-up is useful beyond ChatGPT, because the weakness is a very common web mistake: a message handler that trusts whoever sends it a message.

Key points

  • Parameter, a security research firm, published its findings on 28 October 2026; it reported the bug to OpenAI on 18 October and says OpenAI fixed it by 26 October.
  • Opening a malicious shared link was the only required step in the most severe version; in an earlier version the victim also clicked "Preview" once.
  • Parameter says the code ran as chatgpt.com, listed the victim's recent conversations, opened a private chat the attacker had never been given and sent part of it to a server the researchers controlled.
  • OpenAI raised the severity from P2 to P1 on 21 October and paid $5,000 in total, per Parameter; The Hacker News and a second write-up by Parameter's author report the same dates.
  • No real-world exploitation is reported. The private-chat proof was run between accounts the researchers controlled.

What to do

  • ChatGPT users: you do not need to update anything or change your password because of this bug. The fix was rolled out server-side across both versions of ChatGPT's web frontend, according to Parameter.
  • Be careful with shared links in general. A share link opens a page that runs interactive features. Treat a link from someone you do not know as you would any unknown web link.
  • Developers: search your code for addEventListener('message', ...) and onmessage =. Any handler that does not check event.origin and event.source before acting is the same pattern. Details are under "How it works".

What happened

Parameter's write-up, dated 28 October, describes an attack that started with a normal ChatGPT feature: a shared conversation. The researchers built a conversation that contained an interactive graph and an HTML preview, published it with ChatGPT's share function and sent the link to a second account. When that account opened the link, attacker-controlled JavaScript ran with the identity of chatgpt.com, the same origin as the real site.

From there, Parameter says, the code could call ChatGPT's authenticated APIs as the victim, which it describes as an account takeover. In its proof, the script listed the victim's recent conversations, retrieved a private conversation the attacker had no access to and sent a copy to a server the researchers controlled. The Hacker News reports the same chain and the same limits.

Parameter lists its timeline as follows. On 13 October it confirmed that a message could become HTML in production code; on 14 October it reached arbitrary JavaScript through the normal interface; on 16 October it showed delivery between two separate accounts with one Preview click; and on 17 October it made Preview open automatically on navigation. It submitted the bug to OpenAI's bug bounty programme on 18 October. OpenAI reproduced it on 21 October and raised the severity from P2 to P1. On 22 October one web frontend was fixed while the second was still being updated, and on 23 October content security policy changes blocked part of the chain. On 26 October OpenAI confirmed both frontends rejected the messages and marked the issue resolved, with a total bounty of $5,000.

OpenAI's response is described only through Parameter. Neither The Hacker News nor Parameter's post includes a statement from OpenAI, and we did not find one.

Background

The browser feature at the centre of this is postMessage, which lets one window or frame send data to another, including across origins. It is how sandboxed previews talk to the page that hosts them. The standard rule is that the receiving window must check who sent the message (event.origin, and the exact window in event.source) before it does anything with it. Skipping that check is a well-known class of bug, and researchers have repeatedly found cross-site scripting in ChatGPT's interface; Imperva described chained XSS flaws there in 2024. This is a different bug.

AI products add pressure to this area. They render model output, graphs, code previews and shared conversations in the page, usually through sandboxed frames, so the boundary between "content" and "the app" matters more than on an ordinary website.

How it works

Parameter describes five steps. All of them are from its account; we have not tested them.

  1. A shared chat contains an interactive graph. Rendering it makes ChatGPT load MathLive, an open-source maths-keyboard library, into the main page.
  2. MathLive's message listener did not verify the sender. It accepted a message that changed a setting and could carry raw HTML for the on-screen keyboard layout.
  3. The sandboxed Preview frame could therefore send a message that put attacker HTML into the trusted main page.
  4. That HTML created an unsandboxed frame, which inherited the chatgpt.com identity.
  5. ChatGPT's content security policy blocked inline scripts but allowed scripts from YouTube. Parameter used a YouTube endpoint that echoes a callback name to get JavaScript to run.

Parameter says the YouTube step was a workaround, not the root cause. Blocking it alone would not have closed the hole, which is why OpenAI's fix rejects the cross-frame messages. The three ingredients it names are a listener that acts without checking the sender, a message that can carry HTML and HTML that can create an unsandboxed frame. Parameter's recommended defences are to verify both the sender's origin and the exact window before accepting any state-changing message, never to pass raw HTML through cross-window settings, to keep dynamically created documents sandboxed when an untrusted frame can influence them, and to treat CSP as a backup rather than the only barrier.

The Hacker News adds that one version needed one click on Preview and that the automatic version fired about 4.5 seconds after the page opened, in Parameter's tests of three runs in a separate account.

What it means

For ChatGPT users. Based on what has been published, the risk has passed: the bug was fixed before the public write-up, and no abuse is reported. The episode shows that "opening a link" can be enough to hand over a session, even on a trusted domain.

For developers. The lesson is not specific to OpenAI or MathLive. Any third-party library that registers a global message listener runs inside your page's security context. If your app embeds previews, widgets or plugins, check what those libraries listen to.

For AI product teams. Shared conversations are user-generated pages hosted on your domain. Treat them as untrusted input end to end, including anything they cause to be loaded later.

What we don't know yet

  • Whether OpenAI will publish its own account or a statement. Parameter's version of OpenAI's response has not been confirmed by the company in what we found.
  • Whether anyone abused the flaw before the fix. Parameter says it knows of no real-world use, but that is not the same as proof there was none.
  • Whether other products embedding the same library have similar listeners. Parameter does not claim that they do.
  • The timing on 22 and 23 October, when one frontend was patched and the other was not yet; Parameter's description is brief.

What to watch next

  • An OpenAI statement or security advisory about the incident.
  • A fix or hardening release from the MathLive project and similar libraries, and audits of their message handlers.
  • More research on shared-content features in AI products, which is where this bug lived.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next