ChatGPT share links executed JavaScript in signed-in sessions
Original title: We Took over ChatGPT Accounts
Researchers read a private chat and sent it off-site; OpenAI fixed the P1 issue on October 26.
In October 2026, researchers showed that a public ChatGPT share could run attacker-controlled JavaScript inside the signed-in chatgpt.com session of anyone who opened the link. A Preview frame and a MathLive graph listener let untrusted postMessage content become HTML in the main page, then an unsandboxed srcdoc iframe and a YouTube JSONP callback bypassed CSP. They confirmed listing conversations, reading an unshared private chat and calling authenticated APIs as the victim. OpenAI fixed the issue on October 26 and rated the report P1.
Unconfirmed: The post does not say whether anyone besides the researchers used the bug before the fix.
- Opening the shared link was the only action required of the victim.
- MathLive accepted virtual-keyboard messages from any origin and set innerHTML.
- ChatGPT's CSP allowed YouTube scripts, which the researchers used as JSONP.
- The write-up says the bug was fixed on October 26 and classed P1.
Impact: JavaScript execution in the victim's signed-in ChatGPT session
| Product | Affected |
|---|---|
| OpenAI ChatGPT | — |
- ATT&CK
- T1059.007 JavaScript
- Vendors
- OpenAI
From the original article
12 min read at parameter.ai
In October 2026, we found a way to turn an ordinary public ChatGPT share into attacker-controlled JavaScript running inside the signed-in session of whoever opened it. An attacker could create a malicious conversation, publish it using ChatGPT's normal sharing feature, and send the link to another user. When the victim opened the share, the payload executed as chatgpt.
By armcat · parameter.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.