Shared ChatGPT link could run attacker code in a victim's session and read private chats

TLDR

• Parameter says a malicious public ChatGPT share link could run attacker JavaScript in the signed-in session of whoever opened it.¹²
• Researchers read a private chat across test accounts; OpenAI fixed the flaw on 26 October and rated it P1.¹²
• Ostorlab says the fix is server-side, no CVE has been assigned and no real-world abuse is reported.³

Security firm Parameter reports that an ordinary public ChatGPT conversation could be turned into attacker-controlled JavaScript running as chatgpt.com in the signed-in session of anyone who opened the share link.¹ The code could list the victim's recent conversations, retrieve a private conversation that had never been shared with the attacker, and send part of it to a server the researchers controlled.¹ The Hacker News reports the link could be delivered by email, chat message, support ticket or social post, with no install, workspace join or sign-in through the attacker needed.²

Parameter says the chain began with two features that looked harmless alone: an interactive graph and ChatGPT's HTML Preview.¹ The Preview runs inside a restricted frame on a separate web address, and Parameter says that isolation held.¹ The graph, however, loaded the MathLive maths library into the main ChatGPT page, installing a listener for on-screen keyboard messages that, per Parameter, accepted a layout-changing message from any sender, with raw HTML allowed in the layout.¹ That HTML created a frame with no sandbox attribute that inherited the chatgpt.com identity, and ChatGPT's content security policy, which blocked inline code but allowed scripts from YouTube, was bypassed using a callback parameter on YouTube's oEmbed endpoint.¹³

In the most stable version of the attack the victim clicked ChatGPT's Preview button once; in a later version, Parameter says, opening the link was the only step, and it reproduced that automatic path three times in a separate account.¹ Parameter says the code could call ChatGPT's authenticated APIs directly, and wrote: "Essentially, we could perform any action on behalf of the victim's ChatGPT account."¹ The Hacker News reports the work was a controlled test, with the private-chat proof run between separate accounts rather than against real users.²

Parameter says it reported the flaw through OpenAI's bug bounty programme on 18 October, that OpenAI reproduced it on 21 October and raised the severity from P2 to P1, and that OpenAI confirmed on 26 October that both versions of the web frontend rejected the messages the attack relied on.¹ Parameter says OpenAI paid $5,000 in total, and The Hacker News reports the writeup was published on 28 October, after the fix.¹² Ostorlab says the fix is server-side, that no CVE has been assigned and that no real-world abuse is reported.³ Ostorlab also says the public disclosure does not identify a fixed upstream MathLive version.³ MathLive's changelog lists a 31 October release, 0.111.2, whose security notes say keyboard messages now default to same-origin validation, without mentioning ChatGPT, OpenAI or Parameter.⁴

Why it matters: the flaw came from several individually reasonable features combined in one page, and Parameter's lesson is that message receivers must check both the sender's origin and the exact sender frame before acting.¹