THE ESSENTIALS IN 30 SECONDS

  • A malicious shared ChatGPT conversation could run attacker JavaScript as chatgpt.com, list a victim's chats and read private conversations, according to Parameter.
  • The chain abused a MathLive message listener that accepted raw HTML from any frame, plus a YouTube script allowed by ChatGPT's content security policy.
  • Reported on October 18, the flaw was rated P1 and fixed across two web frontends by October 26; OpenAI paid a $5,000 bounty and users need take no action.

OpenAI has closed a vulnerability in ChatGPT's web app that allowed a public share link to run an attacker's code inside the signed-in session of whoever opened it. The issue was found by the security firm Parameter, which reported it through OpenAI's bug bounty program on October 18, 2026, and published a technical writeup on October 28, after the fix.

How the attack worked

ChatGPT's Preview feature renders HTML in a sandboxed frame hosted on a separate domain, and according to the researchers that sandbox itself held. The weakness came from a second component on the same page. A shared conversation containing an interactive graph caused ChatGPT to load MathLive, a math-input library, into the main chatgpt.com page. MathLive listened for virtual-keyboard settings messages from other frames without checking who sent them, and those messages could carry raw HTML as keyboard-layout data.

The attacker's Preview frame used this to inject HTML into the main page, which created an unsandboxed frame that the browser treated as part of chatgpt.com. Because ChatGPT's content security policy blocked inline scripts but allowed YouTube, the payload loaded a YouTube URL whose callback carried the attacker's JavaScript. Ostorlab notes that the YouTube step was only a workaround: the underlying problem was the unchecked HTML injection.

The victim did not need to install anything or sign in through the attacker. In the most reliable version, they had to click Preview once; a later variant opened Preview automatically.

What was exposed

In tests between their own accounts, Parameter's code listed recent conversations, opened a private chat never shared with the attacker and sent part of it to a server the researchers controlled. Ostorlab adds that the payload could read the session access token and account ID. The researchers said they could perform any action on the victim's account, within the limits of what the logged-in frontend can do. Parameter reported no exploitation in the wild, and no CVE has been assigned.

The fix

OpenAI reproduced the proofs of concept, raised the severity from P2 to P1, its top category, and patched two versions of ChatGPT's web frontend, with both rejecting the attack's messages by October 26. It paid a $5,000 bounty. OpenAI has not issued a public statement beyond these steps. Because the fix is server-side, users have nothing to install or reset. For developers who embed MathLive, Ostorlab says no fixed library version has been identified and advises checking message senders and sandboxing dynamically created frames.