ChatGPT Shared-Link Flaw Enabled Private Chat Theft and Authenticated Account Actions

Parameter researchers demonstrated a ChatGPT vulnerability that allowed a crafted shared conversation link to execute attacker-controlled JavaScript in a visitor’s signed-in browser session, read private conversations, and perform account actions. The attack chained sandboxed Preview content with a MathLive message listener that accepted untrusted cross-window messages containing raw HTML, enabling execution under the chatgpt.com origin. The most reliable version required the visitor to open the link and click Preview; a later variant reportedly opened Preview automatically. A follow-up account also described an allowlisted YouTube oEmbed JSONP endpoint as a Content Security Policy bypass, although that report did not independently substantiate the complete chain.

Parameter reported the vulnerability to OpenAI on October 18, and OpenAI fixed it by October 26, before public disclosure. OpenAI upgraded the finding from P2 to P1 and awarded a $5,000 bounty; the follow-up report identified MathLive version 0.111.2 as the upstream fix. Although researchers characterized the impact as full account takeover, the demonstrated risk was code execution and access to data and actions available within an authenticated browser session. Testing used controlled accounts, no exploitation in the wild was reported, and users were not required to take remediation steps.