Parameter discloses ChatGPT shared-link flaw allowing attacker JavaScript in victim sessions and private chat theft; OpenAI fixed it
Researchers at Parameter showed that a malicious ChatGPT shared-conversation link could run attacker code inside the logged-in session of anyone who opened it, exposing private conversations. The flaw was reported via OpenAI's bug bounty on October 18, rated P1 (raised from P2), and fixed by October 26. Exploitation needed only one click on the Preview button, and a later variant needed only opening the link. Parameter reports no real-world abuse; the private-chat proof was run between separate test accounts. OpenAI paid $5,000 and Parameter published its writeup on October 28.
Entenda a falha
A vulnerabilidade
A flaw in the ChatGPT web frontend let a malicious shared-conversation link run attacker JavaScript in the signed-in session of whoever opened it, exposing private chats and, in principle, any action as the victim. The bug is a message listener that the MathLive library leaves in the main chatgpt.com page. The attacker needs no authentication and no victim configuration: the victim opens the link and clicks Preview once, and a later variant needed only opening the link. OpenAI fixed it server-side across two web frontend versions by October 26. No CVE was assigned, and users need to do nothing.
Como funciona
A shared chat contains HTML that the Preview feature renders in a sandboxed frame on a separate origin, and that sandbox held. The same chat also has an interactive graph, and drawing it loads MathLive into the main chatgpt.com page, which leaves a listener for on-screen keyboard messages. The Preview frame sends such a message, and the listener accepts it from any sender, with raw HTML allowed as keyboard-layout data. The HTML builds a non-sandboxed frame that inherits the chatgpt.com identity, and a script from YouTube, allowed by the content security policy, supplies the code that runs there. That code calls ChatGPT's signed-in APIs, lists recent conversations and reads a private one.
Por que é vulnerável
Parameter traces it to three design choices that lined up: MathLive acted on a message that changed its settings without checking which frame sent it, that message could carry raw HTML as keyboard-layout data, and the HTML could create a frame that was not sandboxed and inherited the chatgpt.com identity. The researchers say the YouTube allowance in the content security policy was only the final workaround, and blocking it alone would still let an untrusted Preview push HTML into the main site. OpenAI's fix makes both web frontend versions reject the abused messages.
Onde está
The articles name the MathLive on-screen keyboard message listener loaded into the main chatgpt.com page, but give no file, function or commit.
Como foi descoberta
Researchers at the security firm Parameter found the flaw and reported it through OpenAI's bug bounty on October 18. OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1 and had a fix in place by October 26. OpenAI paid $5,000 in total. Parameter published its writeup on October 28, after the fix, and reports no real-world abuse; the private-chat proof ran between separate test accounts.
Explicação gerada por IA a partir da matéria e dos artigos, em 31/10/2026 04:15.
Detalhes técnicos
- ChatGPT's Preview feature renders chat HTML in a sandboxed frame on a separate origin. The sandbox itself held.
- The shared chat also contained an interactive graph. Drawing it loaded the MathLive library into the main chatgpt.com page, leaving a message listener for its on-screen keyboard.
- The listener accepted messages from any sender without checking the origin, and allowed raw HTML as keyboard-layout data. The Preview frame could therefore push attacker HTML into the trusted main page.
- That HTML created a non-sandboxed frame that inherited the chatgpt.com identity. A script loaded from YouTube, which the content security policy allowed, supplied the code that ran in it.
- The injected code called ChatGPT's signed-in APIs directly, listed recent conversations, read a private chat and exfiltrated part of it to a researcher-controlled server. In principle it could perform any action as the victim.
- Parameter says the YouTube allowance was only the final workaround, not the root cause. The root causes were the missing origin check, HTML allowed in keyboard-layout data, and the unsandboxed frame.
Remediação
- OpenAI fixed the issue server-side across two versions of the web frontend, and both rejected the abused messages by October 26.
- ChatGPT users need to take no action.
Linha do tempo
-
Parameter discloses ChatGPT shared-link flaw allowing attacker JavaScript in victim sessions and private chat theft; OpenAI fixed it
ler a análise desta fonte ocultar
Researchers at Parameter showed that a malicious ChatGPT shared-conversation link could run attacker code inside the logged-in session of anyone who opened it, exposing private conversations. The flaw was reported via OpenAI's bug bounty on October 18, rated P1 (raised from P2), and fixed by October 26. Exploitation needed only one click on the Preview button, and a later variant needed only opening the link. Parameter reports no real-world abuse; the private-chat proof was run between separate test accounts. OpenAI paid $5,000 and Parameter published its writeup on October 28.
Technical Details
- ChatGPT's Preview feature renders chat HTML in a sandboxed frame on a separate origin. The sandbox itself held.
- The shared chat also contained an interactive graph. Drawing it loaded the MathLive library into the main chatgpt.com page, leaving a message listener for its on-screen keyboard.
- The listener accepted messages from any sender without checking the origin, and allowed raw HTML as keyboard-layout data. The Preview frame could therefore push attacker HTML into the trusted main page.
- That HTML created a non-sandboxed frame that inherited the chatgpt.com identity. A script loaded from YouTube, which the content security policy allowed, supplied the code that ran in it.
- The injected code called ChatGPT's signed-in APIs directly, listed recent conversations, read a private chat and exfiltrated part of it to a researcher-controlled server. In principle it could perform any action as the victim.
- Parameter says the YouTube allowance was only the final workaround, not the root cause. The root causes were the missing origin check, HTML allowed in keyboard-layout data, and the unsandboxed frame.
Remediation
- OpenAI fixed the issue server-side across two versions of the web frontend, and both rejected the abused messages by October 26.
- ChatGPT users need to take no action.