Researchers show a shared ChatGPT link could take over the account of whoever opened it

Security firm Parameter Labs published a report on October 28, 2026, showing how an ordinary public ChatGPT share link could run attacker-written JavaScript in the signed-in session of anyone who opened it. According to the researchers, that code could list the victim's conversations, read a private one, and send data to an outside server. They say OpenAI fixed the flaw on October 26 and classified it as P1.

How the chain worked

ChatGPT can turn an HTML code block into a small working page called a Preview. That page runs in a sandbox: a restricted frame (iframe) on a different web address, so its code cannot read the ChatGPT page around it. The researchers say the sandbox itself held.

The weak point was a second feature in the same conversation. When ChatGPT draws an interactive graph, it loads MathLive, an open source library for typing math. MathLive set up a listener for postMessage, the browser mechanism that lets two frames exchange messages, and that listener accepted messages from any origin, meaning any combination of protocol, domain, and port.

One message type let the sender replace the layout of MathLive's on-screen keyboard, and the layout could contain raw HTML. MathLive wrote that HTML into the main ChatGPT page through innerHTML. The researchers used it to insert an iframe with a srcdoc attribute and no sandbox, which the browser treated as part of chatgpt.com.

ChatGPT's Content Security Policy (CSP), the list of places a page may load scripts from, blocked inline code but allowed YouTube. According to the report, YouTube's oEmbed endpoint echoed a callback name back as executable JavaScript before rejecting it. That gave the researchers code running as chatgpt.com.

What a victim had to do

To deliver the attack, the researchers put a genuine graph and an HTML Preview into one public conversation and shared it. In their most stable version, the victim opened the link and clicked Preview once. In a later version the Preview started on its own, so opening the link was the only action.

The researchers say they submitted the report to OpenAI's bug bounty program on October 18, 2026. By their account, OpenAI raised the severity from P2 to P1 on October 21, 2026, and paid a total bounty of $5,000.

What changed in MathLive

MathLive released version 0.111.2 on October 31, 2026, with a security section in its changelog. Messages to the virtual keyboard, the proxy, and the math field now accept only the same origin by default. Integrations that work across origins must explicitly list the peer origins they trust.

Settings sent from another window can no longer supply custom keyboard layouts or keycap overrides, even with origin validation turned off. Custom HTML layouts now have to be configured in the window that hosts the keyboard. The current version of the package on npm is 0.111.4.

The changelog mentions neither ChatGPT nor the report. Its changes match the defects the researchers describe, which suggests the release is a response to them.