A critical ChatGPT vulnerability allowed a malicious shared conversation to execute attacker-controlled JavaScript inside another user’s signed-in browser session. The exploit could enumerate private chats, read conversations that had never been shared with the attacker, and exfiltrate data to an external server. In the final demonstration, opening a single crafted link was sufficient.
OpenAI patched the issue on October 26, 2026, according to a technical disclosure published by Parameter and posted by Mukul Goyal on October 28. The report was classified as P1 and received a $5,000 bounty. The demonstrated account takeover occurred via the victim’s active browser session rather than by compromising a password.
The exploit combined an interactive graph with ChatGPT’s HTML Preview feature. Preview normally runs content inside an isolated frame at a different origin, preventing it from directly reading the main ChatGPT page. That isolation initially functioned as intended.
ChatGPT Flaw Exploited With One Link
The graph, however, loaded MathLive, a math-rendering library that added a message listener to the main page to support its virtual keyboard. Through the browser’s postMessage interface, the isolated Preview could send messages to that listener. MathLive accepted keyboard-change messages without properly verifying the sender’s origin or requiring that messages come from a specific source window.
One message supplied a keyboard layout containing attacker-controlled HTML. Another message opened the keyboard, causing that HTML to be injected into the real ChatGPT page using innerHTML. A helper function named createHTML forwarded the content without stripping unsafe markup.
This chain differs from an earlier reported ChatGPT sandbox issue that exposed Gmail data via shared internal storage. In this case the escape crossed a browser boundary by exploiting messages that a privileged page component trusted.
Inserting raw HTML alone did not immediately run JavaScript. The researchers included an iframe using the srcdoc attribute, which contains an embedded page’s HTML directly in the attribute. Because the new frame was not sandboxed, it inherited ChatGPT’s origin and gained the ability to access the parent page.
ChatGPT’s Content Security Policy blocked inline scripts but permitted scripts loaded from YouTube. The researchers discovered that YouTube’s oEmbed endpoint returned an attacker-supplied JSONP callback as executable JavaScript—even when the callback parameter was invalid. Loading that response provided the final step needed to run code with the chatgpt.com origin.
The researchers placed both the interactive graph and the HTML Preview into a public conversation. An earlier proof-of-concept required a user to click Preview; the final version opened Preview automatically. The exploit was reproduced three times in a separate account, with code execution occurring after roughly 4.5 seconds.
Private Chat Theft and OpenAI’s Fix
The payload read session details already available to ChatGPT’s frontend and called authenticated conversation APIs. It retrieved a private conversation unrelated to the shared link and exfiltrated a small selected value to a researcher-controlled server using an image request.
Unlike a separately reported ChatGPT GitHub connector flaw, this attack did not rely on repository instructions or connected tools. Its access resulted directly from JavaScript running inside the trusted website context.
Parameter submitted the vulnerability report on October 18. OpenAI reproduced the issue and raised its severity on October 21, and by October 26 both affected web frontend versions had been updated to reject the problematic MathLive messages. The incident underscores why cross-frame message receivers must validate both the sender origin and the source window, and why untrusted HTML should remain sandboxed throughout rendering.
Give your SOC the alert context to stop incidents quickly. Integrate Threat Intel from 16K SOCs.
