TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researchers at Parameter reported that a malicious ChatGPT share link could run JavaScript inside a recipient’s signed-in session, exposing private conversations and enabling account actions. Parameter says OpenAI fixed the flaw on Oct. 26, 2026, and classified the report as P1; the full scope and any exploitation outside the research remain unclear.
Security researchers at Parameter reported that a crafted ChatGPT conversation share could run attacker-controlled JavaScript in the signed-in session of anyone who opened it, potentially exposing private chats and allowing actions on the account. Parameter says it reported the vulnerability to OpenAI, which fixed it on Oct. 26, 2026, and classified the report as P1.
According to Parameter’s report, an attacker could create a conversation containing an interactive graph and an HTML Preview, publish it through ChatGPT’s ordinary sharing feature, and send the public link to a target. The recipient did not need to install an app, join a project, paste code, or open developer tools; opening the link was the only action required for the reported exploit chain.
Parameter says the researchers confirmed that the code could enumerate a user’s conversation list, retrieve material from a private conversation that had not been shared with the attacker, and send information to an external server. It also said the code could make authenticated API requests as the victim. Those are claims from the researchers’ account of their testing; the supplied report does not establish that attackers used the flaw against ChatGPT users in the wild.
The reported chain involved two features: a graph that loaded the MathLive library, and an HTML Preview running in a restricted frame. Parameter says MathLive’s message listener accepted a request from the Preview to change the virtual keyboard layout without checking the sender’s origin. The library then rendered attacker-supplied HTML in the main ChatGPT page. The researchers describe further steps that allowed JavaScript to execute with ChatGPT’s web identity, despite browser isolation and the site’s Content Security Policy.
Private Conversations at Risk
The reported issue matters because a public share link is generally a low-friction way to view a conversation, while the researchers say opening a malicious one could cross from viewing shared material into access to a recipient’s authenticated account. That would put information in private chats at risk, rather than limiting exposure to the conversation the sender chose to publish.
Parameter’s account also illustrates how security boundaries can fail when features interact. The HTML Preview was placed in a separate frame, but a message listener associated with the graph provided a route to inject markup into the main page. The report says the weakness depended on the combined behavior of separate components, not simply on a Preview being able to read the page around it.
OpenAI’s reported P1 classification indicates that the company treated the disclosure as a high-priority security report. Parameter says the issue has been fixed, but the material provided does not describe the precise remediation or whether users needed to take any action. For readers, the clearest practical point is that the researchers’ described attack relied on opening a crafted link; they do not say that ordinary, legitimate shared conversations were themselves compromised.
Products Worth Considering
Anker SOLIX C300 Portable Power Station, 288Wh
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
How the Preview Crossed Its Boundary
ChatGPT’s HTML Preview can render code as a small webpage. Parameter says the Preview ran in a frame on a different web address, which should prevent it from directly inspecting the signed-in ChatGPT page. The researchers’ question was whether it could still communicate with other components through browser messaging.
The report says the graph loaded MathLive, which installed a listener in the main page for messages relating to its virtual keyboard. The browser’s postMessage mechanism permits frames to exchange messages without granting one frame direct access to another’s document. According to Parameter, MathLive accepted a layout-change message without verifying the sender’s origin, then rendered the supplied layout as HTML.
Parameter says the HTML was inserted into an iframe created without a sandbox attribute. It then describes using a script-loading route permitted by ChatGPT’s Content Security Policy, involving YouTube’s oEmbed endpoint and its JSONP callback behavior. The provided source cuts off during that technical explanation, so it does not supply the complete walkthrough or all details of the final execution step.
““The victim did not need to install an App, join a Project, paste code, or open developer tools. Opening the shared link was the only required action.””
— Parameter researchers
Scope and Exploitation Remain Unknown
The source material does not say whether the vulnerability was exploited by anyone outside Parameter’s research, how many accounts may have been exposed, or whether any user data was accessed in real-world attacks. It also does not include a statement from OpenAI, a technical advisory from the company, or details of the fix beyond the reported date and P1 classification.
Parameter describes the chain as capable of taking over a ChatGPT account, but the supplied material does not document every possible account action or establish that every account feature and data type was accessible. The report excerpt also ends during its explanation of the YouTube JSONP step. Impact, exposure, and remediation details beyond the researchers’ claims remain unconfirmed in the material provided.
OpenAI’s Fix and Further Disclosure
Parameter says the issue was fixed on Oct. 26, 2026. The next useful developments would be a fuller technical account from the researchers and a public explanation from OpenAI of what changed, whether the company found evidence of exploitation, and whether affected users were notified. None of those details appears in the supplied source.
Until further information is available, the report supports a narrow conclusion: Parameter says it demonstrated a way for a crafted ChatGPT share to cross an intended security boundary, and says OpenAI patched the issue. It does not establish the scale of any exposure or confirm attacks against users.
Key Questions
What did Parameter say the vulnerability allowed?
Parameter says a crafted ChatGPT share link could run JavaScript in the signed-in session of someone who opened it, allowing the researchers to access private conversation content and send data to an external server.
Did a victim have to install anything?
No. Parameter says the recipient only needed to open the shared link; installing an app, joining a project, pasting code, or opening developer tools was not required.
Has OpenAI fixed the issue?
Parameter says OpenAI fixed it on Oct. 26, 2026, and classified the disclosure as P1. The source provided does not include OpenAI’s own confirmation or details of the patch.
Is there evidence that attackers used the flaw?
The supplied report does not say whether anyone exploited the issue outside the researchers’ testing. The scale of any real-world exposure is therefore unclear.
Source: parameter.ai
