EN PT-BR
← Voltar ao feed
high technology

Parameter discloses ChatGPT shared-link flaw chain letting attacker JavaScript run in victim sessions and read private chats; OpenAI fixed it Oct 26

2 fonte(s) · 2 atualização(ões) · publicado 31/10/2026 02:33 · coletado há 17 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 03/11/2026 00:02; os links antigos trazem para cá.

Fontes: gbhackers.com ↗ thehackernews.com ↗

Researchers at Parameter disclosed a chain of flaws in ChatGPT that turned a malicious shared-conversation link into attacker-controlled JavaScript running in the victim's signed-in chatgpt.com session, exposing private conversations (thehackernews.com, gbhackers.com). The bug was reported through OpenAI's bug bounty, rated P1 (raised from P2) and fixed by October 26. OpenAI paid a $5,000 bounty, and Parameter published its writeup on October 28 (thehackernews.com). The first exploit needed one click on the Preview button, and a later variant needed only opening the link (thehackernews.com). Parameter reports no real-world abuse, and the private-chat proof was run between separate test accounts (thehackernews.com). ChatGPT users need to take no action. The article from gbhackers.com notes that threat actors already abuse legitimate ChatGPT shared links to host ClickFix lures leading to a NetSupport RAT, so flaws like this make shared links a more attractive delivery route.

Entenda a falha

A vulnerabilidade

A chain of flaws in ChatGPT's web frontend let a crafted public shared-conversation link run attacker JavaScript in the victim's signed-in chatgpt.com session. The entry point was the MathLive library, loaded by an interactive graph in the shared chat, whose postMessage listener for the on-screen keyboard accepted messages from any origin. The attacker needs no authentication or configuration. The first exploit needed one click on Preview, and a later variant needed only opening the link. The attacker could read the session token and account ID, list and read private chats, and in principle act as the victim. No CVE was assigned. OpenAI fixed it server-side by October 26 and rated it P1. The articles give no MathLive versions, and users need to do nothing.

Como funciona

The victim opens a shared conversation containing an interactive graph, which loads MathLive into the main chatgpt.com page. MathLive registers a postMessage listener for its on-screen keyboard. Code in the isolated HTML Preview frame sends two messages: one replaces the keyboard layout with raw HTML, the other tells MathLive to show the keyboard. MathLive inserts the markup via innerHTML, and the createHTML helper marks it trusted without sanitizing. The markup creates an unsandboxed srcdoc iframe that inherits the chatgpt.com origin. The CSP blocks inline scripts but allows YouTube scripts, and a reflected JSONP callback on YouTube's oEmbed endpoint becomes a script the browser runs as trusted. That code reads the session token and calls /backend-api/conversations. In the most stable test it ran about 4.5 seconds after the link opened.

Por que é vulnerável

Several design choices lined up. The MathLive listener acted on a settings-changing message without checking which frame sent it (neither event.origin nor event.source). That message could carry raw HTML as keyboard-layout data, and createHTML marked it trusted before the innerHTML insertion. The injected HTML could create an unsandboxed frame inheriting the chatgpt.com identity. Parameter says the YouTube allowance in the CSP was only the final workaround, not the root cause. The Preview sandbox itself held; the weakness was in another component of the main page. The fix makes both web frontend versions reject the abused cross-frame MathLive messages.

Onde está

The articles name no file or commit; they point to MathLive's on-screen keyboard postMessage listener on the main chatgpt.com page, its createHTML helper and innerHTML insertion, and the /backend-api/conversations endpoint read by the injected code.

Como foi descoberta

Researchers at Parameter found the chain and reported it through OpenAI's bug bounty on October 18, according to The Hacker News. gbhackers says OpenAI reproduced it on October 21; the dates are not necessarily contradictory. OpenAI raised the severity from P2 to P1, fixed it by October 26 and paid $5,000. Parameter published its full write-up on October 28, after the fix, and press coverage followed on October 31 and November 2. Parameter reports no real-world abuse; the private-chat proof ran between separate test accounts. gbhackers notes that attackers already abuse legitimate ChatGPT shared links to host ClickFix lures leading to a NetSupport RAT.

PoC pública

Parameter published a full technical write-up on October 28 after the fix. It describes a working chain from a shared link to code execution in the victim's session, shown in controlled tests with the private-chat read run between separate test accounts. The articles give no repository or tool and no link to the write-up. Since the fix is server-side and users need no action, patching urgency is low. The main lesson is for developers who use postMessage.

Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 00:17.

Detalhes técnicos

  • ChatGPT's Preview feature renders chat HTML in a sandboxed frame on a separate origin. The sandbox itself held (thehackernews.com).
  • A crafted shared chat contained an interactive graph. Drawing it loaded the MathLive library into the main chatgpt.com page, which registered a postMessage listener for its on-screen keyboard (thehackernews.com, gbhackers.com).
  • The listener accepted an update-setting message from any origin without validating the sender, and allowed raw HTML as keyboard-layout data (thehackernews.com, gbhackers.com).
  • Code in the Preview frame sent two messages: one supplied the layout and the other told MathLive to display the keyboard. MathLive inserted the markup via innerHTML, and the createHTML helper marked it trusted without sanitizing it (gbhackers.com).
  • The injected HTML created an unsandboxed srcdoc iframe that inherited the chatgpt.com origin and could interact with the parent page (thehackernews.com, gbhackers.com).
  • ChatGPT's CSP blocked inline scripts but allowed scripts from YouTube. YouTube's oEmbed endpoint reflected a JSONP callback parameter, and ending the callback with ;void neutralized the appended error object. The browser then ran the attacker's code as a trusted script (gbhackers.com).
  • The injected code read the session token and account ID and listed conversations via /backend-api/conversations. It read a private chat and exfiltrated a small piece of data through an image request to a researcher-controlled server. In principle it could perform any action as the victim (gbhackers.com, thehackernews.com).
  • In the most stable test, only opening the link was required, and the payload ran after roughly 4.5 seconds (gbhackers.com).
  • Parameter says the YouTube allowance was only the final workaround. The root causes were the missing origin check, HTML allowed in keyboard-layout data, and the unsandboxed frame (thehackernews.com).

Remediação

  • OpenAI fixed the issue server-side across two versions of the web frontend. Both now reject the abused cross-frame MathLive messages, as of October 26 (thehackernews.com, gbhackers.com).
  • Developers should verify both event.origin and event.source before accepting state-changing messages (gbhackers.com).
  • Cross-window settings should never carry raw HTML (gbhackers.com).
  • Documents built from untrusted content should stay sandboxed (gbhackers.com).
  • CSP should be a backup control, not the only barrier (gbhackers.com).

Relatos divergentes

  • Report and reproduction dates: thehackernews.com says the bug was reported on October 18. gbhackers.com says OpenAI reproduced it on October 21. These are not necessarily contradictory, since one is the report date and the other the reproduction date.
  • User interaction required: thehackernews.com describes one click on Preview for the initial exploit and an open-only variant later. gbhackers.com stresses that the victim only had to open the link. Both agree that the most refined variant needs no click.

Linha do tempo

  1. gbhackers.com ↗ · pub. 02/11/2026 07:58 · coletado 02/11 08:00

    ChatGPT shared-link flaw chain let attackers run JavaScript in victims' sessions and read private chats; OpenAI fixed it Oct 26

    ler a análise desta fonte

    Researchers at Parameter disclosed a chain of flaws in ChatGPT that turned a public shared-conversation link into attacker-controlled JavaScript running in the victim's signed-in chatgpt.com session. The victim only had to open the link. OpenAI reproduced the bug on October 21, raised it from P2 to P1, and fixed it by October 26. The researchers received a $5,000 bounty.

    Technical Details

    • A crafted shared conversation contained an interactive graph that loaded the MathLive library. MathLive registered a postMessage listener on the main page for its on-screen keyboard.
    • The listener accepted an update-setting message from any origin and did not validate the sender. The keyboard layout could therefore be replaced with raw HTML.
    • Code in the isolated HTML Preview frame sent two messages: one supplied the layout and the other told MathLive to display the keyboard. MathLive inserted the markup via innerHTML, and the createHTML helper marked it trusted without sanitizing it.
    • The researchers injected an unsandboxed srcdoc iframe that inherited the chatgpt.com origin and could interact with the parent page.
    • ChatGPT's CSP blocked inline scripts but allowed scripts from YouTube. YouTube's oEmbed endpoint reflected a JSONP callback parameter, and ending the callback with ;void neutralized the appended error object. The browser then executed the attacker's code as a trusted script.
    • The injected code read the session token and account ID and listed conversations via /backend-api/conversations. It retrieved a private chat and exfiltrated a small piece of data through an image request to a researcher-controlled server. In principle it could perform any action the victim could.
    • In the most stable test, only opening the link was required, and the payload ran after roughly 4.5 seconds.

    Remediation

    • OpenAI fixed the issue by October 26. Both web frontends now reject the cross-frame MathLive messages.
    • Receivers should verify both event.origin and event.source before accepting state-changing messages.
    • Cross-window settings should never carry raw HTML.
    • Documents built from untrusted content should stay sandboxed.
    • CSP should be a backup control, not the only barrier.

    The article notes that threat actors already abuse legitimate ChatGPT shared links to host ClickFix lures leading to a NetSupport RAT, so flaws like this make shared links a more attractive delivery route.

  2. thehackernews.com ↗ · pub. 31/10/2026 02:33 · coletado 31/10 04:00 primeiro registro

    Parameter discloses ChatGPT shared-link flaw allowing attacker JavaScript in victim sessions and private chat theft; OpenAI fixed it

    ler a análise desta fonte

    Researchers at Parameter showed that a malicious ChatGPT shared-conversation link could run attacker code inside the logged-in session of anyone who opened it, exposing private conversations. The flaw was reported via OpenAI's bug bounty on October 18, rated P1 (raised from P2), and fixed by October 26. Exploitation needed only one click on the Preview button, and a later variant needed only opening the link. Parameter reports no real-world abuse; the private-chat proof was run between separate test accounts. OpenAI paid $5,000 and Parameter published its writeup on October 28.

    Technical Details

    • ChatGPT's Preview feature renders chat HTML in a sandboxed frame on a separate origin. The sandbox itself held.
    • The shared chat also contained an interactive graph. Drawing it loaded the MathLive library into the main chatgpt.com page, leaving a message listener for its on-screen keyboard.
    • The listener accepted messages from any sender without checking the origin, and allowed raw HTML as keyboard-layout data. The Preview frame could therefore push attacker HTML into the trusted main page.
    • That HTML created a non-sandboxed frame that inherited the chatgpt.com identity. A script loaded from YouTube, which the content security policy allowed, supplied the code that ran in it.
    • The injected code called ChatGPT's signed-in APIs directly, listed recent conversations, read a private chat and exfiltrated part of it to a researcher-controlled server. In principle it could perform any action as the victim.
    • Parameter says the YouTube allowance was only the final workaround, not the root cause. The root causes were the missing origin check, HTML allowed in keyboard-layout data, and the unsandboxed frame.

    Remediation

    • OpenAI fixed the issue server-side across two versions of the web frontend, and both rejected the abused messages by October 26.
    • ChatGPT users need to take no action.