EN PT-BR
← Voltar ao feed
high technology

ChatGPT shared-link flaw chain let attackers run JavaScript in victims' sessions and read private chats; OpenAI fixed it Oct 26

1 fonte(s) · 1 atualização(ões) · publicado 02/11/2026 07:58 · coletado há 2 horas

Researchers at Parameter disclosed a chain of flaws in ChatGPT that turned a public shared-conversation link into attacker-controlled JavaScript running in the victim's signed-in chatgpt.com session. The victim only had to open the link. OpenAI reproduced the bug on October 21, raised it from P2 to P1, and fixed it by October 26. The researchers received a $5,000 bounty.

Entenda a falha

A vulnerabilidade

A chain of flaws in ChatGPT's web frontend let a crafted public shared-conversation link run attacker JavaScript in the victim's signed-in chatgpt.com session. The entry point was the MathLive library, loaded by an interactive graph in the shared chat. MathLive's postMessage listener for its on-screen keyboard accepted messages from any origin. The attacker needs no authentication and no configuration; the victim only has to open the link. The attacker can read the session token and account ID, list and read private conversations, and in principle do anything the victim can. No CVE was assigned. OpenAI fixed it by October 26; the articles give no MathLive version numbers.

Como funciona

The victim opens a shared conversation containing an interactive graph, which loads MathLive on the main page. MathLive registers a postMessage listener for its on-screen keyboard. Code in the isolated HTML Preview frame sends two messages: one replaces the keyboard layout with raw HTML, the other tells MathLive to show the keyboard. MathLive inserts the markup into the page via innerHTML, and the createHTML helper marks it trusted without sanitizing. The injected markup is an unsandboxed srcdoc iframe that inherits the chatgpt.com origin. The CSP blocks inline scripts but allows YouTube scripts, and a reflected JSONP callback on YouTube's oEmbed endpoint turns into a script the browser runs as trusted. That code then reads the session token and calls the conversations endpoint. In the most stable test it ran about 4.5 seconds after the link was opened.

Por que é vulnerável

Several weaknesses were chained. The MathLive listener did not validate the sender (neither event.origin nor event.source) before accepting a state-changing message. A cross-window setting could carry raw HTML, and createHTML marked it trusted without sanitizing before the innerHTML insertion. The injected iframe was not sandboxed. The CSP also trusted YouTube, whose oEmbed endpoint reflects a JSONP callback, so it worked around the inline-script block. The isolation of the HTML Preview frame held, but the weakness sat in another component of the main page. The fix makes both web frontends reject the cross-frame MathLive messages.

Onde está

The articles name no file or commit; they point to MathLive's on-screen keyboard postMessage listener on the main chatgpt.com page, its createHTML helper and innerHTML insertion, and the /backend-api/conversations endpoint read by the injected code.

Como foi descoberta

Researchers at Parameter found and reported the chain and published a full technical write-up. OpenAI reproduced it on October 21, raised its severity from P2 to P1 and fixed it by October 26. The researchers received a $5,000 bounty. The articles do not say when it was first reported. Public coverage appeared around November 2. The articles add that attackers already abuse legitimate ChatGPT shared links to host ClickFix lures leading to a NetSupport RAT, which makes such flaws attractive for delivery.

Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 08:16.

Detalhes técnicos

  • A crafted shared conversation contained an interactive graph that loaded the MathLive library. MathLive registered a postMessage listener on the main page for its on-screen keyboard.
  • The listener accepted an update-setting message from any origin and did not validate the sender. The keyboard layout could therefore be replaced with raw HTML.
  • Code in the isolated HTML Preview frame sent two messages: one supplied the layout and the other told MathLive to display the keyboard. MathLive inserted the markup via innerHTML, and the createHTML helper marked it trusted without sanitizing it.
  • The researchers injected an unsandboxed srcdoc iframe that inherited the chatgpt.com origin and could interact with the parent page.
  • ChatGPT's CSP blocked inline scripts but allowed scripts from YouTube. YouTube's oEmbed endpoint reflected a JSONP callback parameter, and ending the callback with ;void neutralized the appended error object. The browser then executed the attacker's code as a trusted script.
  • The injected code read the session token and account ID and listed conversations via /backend-api/conversations. It retrieved a private chat and exfiltrated a small piece of data through an image request to a researcher-controlled server. In principle it could perform any action the victim could.
  • In the most stable test, only opening the link was required, and the payload ran after roughly 4.5 seconds.

Remediação

  • OpenAI fixed the issue by October 26. Both web frontends now reject the cross-frame MathLive messages.
  • Receivers should verify both event.origin and event.source before accepting state-changing messages.
  • Cross-window settings should never carry raw HTML.
  • Documents built from untrusted content should stay sandboxed.
  • CSP should be a backup control, not the only barrier.

The article notes that threat actors already abuse legitimate ChatGPT shared links to host ClickFix lures leading to a NetSupport RAT, so flaws like this make shared links a more attractive delivery route.

Linha do tempo

  1. gbhackers.com ↗ · pub. 02/11/2026 07:58 · coletado 02/11 08:00 primeiro registro

    ChatGPT shared-link flaw chain let attackers run JavaScript in victims' sessions and read private chats; OpenAI fixed it Oct 26

    ler a análise desta fonte

    Researchers at Parameter disclosed a chain of flaws in ChatGPT that turned a public shared-conversation link into attacker-controlled JavaScript running in the victim's signed-in chatgpt.com session. The victim only had to open the link. OpenAI reproduced the bug on October 21, raised it from P2 to P1, and fixed it by October 26. The researchers received a $5,000 bounty.

    Technical Details

    • A crafted shared conversation contained an interactive graph that loaded the MathLive library. MathLive registered a postMessage listener on the main page for its on-screen keyboard.
    • The listener accepted an update-setting message from any origin and did not validate the sender. The keyboard layout could therefore be replaced with raw HTML.
    • Code in the isolated HTML Preview frame sent two messages: one supplied the layout and the other told MathLive to display the keyboard. MathLive inserted the markup via innerHTML, and the createHTML helper marked it trusted without sanitizing it.
    • The researchers injected an unsandboxed srcdoc iframe that inherited the chatgpt.com origin and could interact with the parent page.
    • ChatGPT's CSP blocked inline scripts but allowed scripts from YouTube. YouTube's oEmbed endpoint reflected a JSONP callback parameter, and ending the callback with ;void neutralized the appended error object. The browser then executed the attacker's code as a trusted script.
    • The injected code read the session token and account ID and listed conversations via /backend-api/conversations. It retrieved a private chat and exfiltrated a small piece of data through an image request to a researcher-controlled server. In principle it could perform any action the victim could.
    • In the most stable test, only opening the link was required, and the payload ran after roughly 4.5 seconds.

    Remediation

    • OpenAI fixed the issue by October 26. Both web frontends now reject the cross-frame MathLive messages.
    • Receivers should verify both event.origin and event.source before accepting state-changing messages.
    • Cross-window settings should never carry raw HTML.
    • Documents built from untrusted content should stay sandboxed.
    • CSP should be a backup control, not the only barrier.

    The article notes that threat actors already abuse legitimate ChatGPT shared links to host ClickFix lures leading to a NetSupport RAT, so flaws like this make shared links a more attractive delivery route.