Malicious ChatGPT Shared Links Could Expose Private Conversations and Account Access

Severity

Medium

Security researchers from Parameter discovered a vulnerability chain in ChatGPT that could allow attackers to execute malicious JavaScript within a victim’s authenticated session through a specially crafted conversation-sharing link.

The attack could expose private conversations that were never shared publicly and potentially allow attackers to perform actions using the victim’s ChatGPT account. The vulnerability affected ChatGPT’s web interface and did not require victims to download or install additional software.

The issue was reported to OpenAI on October 18, 2026. After reproducing the findings, OpenAI increased the severity from P2 to P1 and deployed a fix across both versions of its web frontend on October 26, 2026. The researchers received a $5,000 bug bounty for the discovery. No real-world exploitation was reported by the researchers.

How?

The attack begins when a victim opens a specially crafted ChatGPT conversation shared through a public link. The conversation contains an interactive graph that loads the MathLive JavaScript library, which provides an on-screen keyboard for mathematical input.

Researchers discovered that MathLive’s postMessage listener accepted messages from any origin without verifying the sending window. This allowed malicious content within the shared conversation’s HTML Preview to send messages that modified the keyboard layout using attacker-controlled HTML.

Although ChatGPT’s HTML Preview was designed to run untrusted content inside a restricted frame, the researchers found a weakness in how the main page handled these cross-frame messages. By injecting an unsandboxed iframe through the keyboard layout, the attackers could execute JavaScript with the security context of chatgpt.com.

The injected code then abused ChatGPT’s Content Security Policy (CSP) by using YouTube’s oEmbed endpoint to execute JavaScript through a JSONP callback. This allowed the malicious code to bypass restrictions that normally prevent unauthorized scripts from running within the page.

Once executed, the JavaScript could access the victim’s session token and account ID. It then used ChatGPT’s internal API to retrieve the victim’s recent conversation history, including private chats that had never been shared with the attacker. The collected information could subsequently be transmitted to an external server.

The researchers demonstrated that the attack could also perform actions on behalf of the authenticated user, potentially providing broader access to the victim’s ChatGPT account.

In the most reliable version of the attack, the victim only needed to open the shared link and click the Preview button once. A later variation removed this additional interaction, allowing the malicious code to execute simply by opening the link. The payload executed approximately 4.5 seconds after the link was opened in the researchers’ most stable test.

Conclusion

The vulnerability demonstrates how seemingly harmless features such as shared conversations, interactive graphs, and HTML previews can introduce security risks when their components do not properly enforce isolation between different execution contexts.

Although OpenAI has already addressed the issue, the findings highlight the potential impact of cross-frame messaging weaknesses and insufficient input validation in web applications. A compromised session could expose private conversation data and allow unauthorized actions without requiring the victim’s credentials to be stolen directly.

Source

https://gbhackers.com/researchers-discover-high-severity-chatgpt-flaw/