OpenAI has patched a flaw in ChatGPT that let a single public share link run attacker-controlled JavaScript inside the signed-in session of whoever opened it. Security firm Parameter found the bug, reported it through OpenAI's bug bounty program on October 18, and published its writeup on October 28 after OpenAI confirmed the fix.
The fix took eight days. OpenAI reproduced the issue on October 21 and raised its severity from P2 to P1, its most serious category. One of ChatGPT's two web frontends was fixed by October 22, and on October 26 OpenAI confirmed both versions rejected the attack messages and marked the issue resolved. Parameter received a $5,000 bounty the same day.
In Parameter's proof of concept, the attacker's code could list a victim's recent conversations, open a private chat that had never been shared, and send a small piece of it to a server the researchers controlled. Parameter said the same access could reach other account actions available through ChatGPT's frontend APIs. The test ran between separate accounts the researchers controlled, and no real-world exploitation was reported.
Key facts
- 01Parameter reported the ChatGPT share-link flaw to OpenAI's bug bounty program on October 18, 2026.
- 02OpenAI raised the severity from P2 to P1 on October 21 and confirmed the fix on October 26, eight days after the report.
- 03The exploit could read a private conversation never shared with the attacker and send part of it to an outside server.
- 04The chain ran through ChatGPT's HTML Preview, the MathLive math library, cross-frame messaging and a YouTube script allowed by policy.
- 05OpenAI paid Parameter a $5,000 bounty; no real-world exploitation was reported and users need to take no action.
Delivery required almost nothing from the victim. The bait was an ordinary ChatGPT share link that could arrive by email, chat, a support ticket or a social post. In the most reliable version, the victim opened the link and clicked Preview once. Parameter later confirmed that Preview could open automatically on navigation, even after a hard refresh, which reduced the attack to opening the link.
The chain combined several features that were each reasonable on their own. ChatGPT's Preview renders HTML from a chat in a sandboxed frame on a separate domain, and that sandbox held. But a shared chat could also contain an interactive graph, and drawing it loaded the MathLive math library into the main ChatGPT page, leaving a message listener running for its on-screen keyboard.
That listener accepted messages from any sender without checking where they came from, and it accepted raw HTML inside keyboard-layout data. Through that channel, the sandboxed Preview could push attacker HTML into the trusted main page. The HTML created a new frame that the browser treated as part of chatgpt.com, without the sandbox.
The last step got past ChatGPT's content security policy. The policy blocked inline scripts but allowed scripts from YouTube, and a YouTube endpoint that echoed a callback parameter supplied the code that ran in the new frame.
Parameter said blocking that YouTube endpoint alone would not have fixed the problem. The firm named three root causes: MathLive acting on a settings-changing message without verifying the sender, that message carrying raw HTML, and the HTML being able to create an unsandboxed frame that inherited the chatgpt.com identity. CSP changes OpenAI shipped on October 23 blocked part of the chain while the second frontend update was still rolling out.
ChatGPT users do not need to install, reset or change anything. The fix was applied on OpenAI's side across both versions of the web frontend.
Parameter's writeup, authored by Mukul Goyal, closes on the design lesson from the bug: "Isolation is only as strong as every bridge across it." A sandboxed frame can still compromise its parent page if a privileged listener there trusts the wrong sender.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
