ChatGPT Share Flaw Allowed Account Takeovers via HTML Previews
Researchers at Parameter Labs uncovered an exploit chain in ChatGPT's HTML previews and MathLive integration that let malicious share links hijack authenticated user sessions.
In short
- Security researchers at Parameter Labs discovered a flaw in ChatGPT shared links that enabled arbitrary JavaScript execution in a victim's signed-in session.
- The attack chain combined an isolated HTML preview, an unvalidated cross-frame message listener in the MathLive graphing library, and a Content Security Policy bypass via YouTube oEmbed.
- OpenAI resolved the vulnerability across its web frontends on October 26, 2026, classified the report as P1 severity, and paid a $5,000 bug bounty.
- The exploit allowed reading private conversation history and issuing authenticated API calls, but testing was confined to researcher accounts with no evidence of real-world exploitation.
Security researchers at Parameter Labs uncovered a critical flaw in ChatGPT's web platform that allowed an attacker to execute arbitrary JavaScript code inside a victim's signed-in session. By tricking an authenticated user into visiting a standard public share link, an attacker could access the victim's account, inspect private chat logs, and exfiltrate conversation data to an external server. OpenAI resolved the issue across its web frontends on October 26, 2026, after raising the report to its highest severity tier, P1, and awarding the researchers a $5,000 bug bounty.
According to a technical write-up published by Parameter Labs, the victim did not need to install an App, join a Project, paste code, or open developer tools. Instead, simply loading a specially prepared shared conversation link on chatgpt.com was sufficient to trigger the exploit chain. Independent technologist Simon Willison highlighted that while ChatGPT's HTML preview sandboxing functioned as intended, an unintended communication pathway between adjacent interface components allowed untrusted markup to escape into the main application document.
Anatomy of the HTML Preview Sandbox Escape
ChatGPT offers an interactive HTML preview feature—formerly referred to by OpenAI as Canvas—that allows users to run interactive web applications. To prevent untrusted code from accessing user data or backend services, ChatGPT executes these previews inside a restricted iframe hosted on a separate web address. In isolation, this boundary operated properly, preventing code inside the preview from directly inspecting the parent document.
However, the researchers discovered that another feature on the page dismantled that barrier. When a shared conversation included an interactive graph, the page initialized a third-party mathematics library called MathLive. Loading MathLive installed a cross-window listener on the main ChatGPT page using the browser's postMessage API to manage on-screen virtual keyboard controls.
As detailed by Parameter Labs, MathLive accepted incoming messages without verifying the sender's origin. Its top-level controller used an origin policy set to accept messages from any web address. Furthermore, the library allowed incoming keyboard layout update messages to include unescaped HTML strings, which it inserted into the main chatgpt.com document using the innerHTML property.
Because innerHTML does not directly execute embedded script tags, the researchers used the injection to create a new, unsandboxed iframe containing a srcdoc attribute. Because the main chatgpt.com page created this frame, the browser assigned it the full web identity of ChatGPT rather than the restricted origin of the preview sandbox.
Bypassing Content Security Policy via YouTube
Even after injecting an unsandboxed document, the exploit encountered ChatGPT's Content Security Policy (CSP), which blocked inline JavaScript execution. To achieve full code execution, the researchers leveraged an exception in OpenAI's CSP rules that allowed scripts to load from YouTube domains.
As reported by Simon Willison, Parameter Labs took advantage of YouTube's oEmbed endpoint, which supported a JSONP callback parameter. While the endpoint was designed to validate callback names, it reflected the user-supplied string into the response body prior to returning an error code. By appending a small JavaScript statement followed by a void operator to the callback parameter, the browser executed the payload as valid script within the trusted origin.
Parameter Labs noted that YouTube's behavior was not the root vulnerability, but rather a conduit exposed by the site's policy settings. The core defect remained the ability of an untrusted iframe to push arbitrary markup into the parent document through an unverified message channel.
From One-Click Interaction to Automatic Execution
The researchers combined the MathLive graph and the malicious preview into a single public conversation link. In their initial testing on October 16, 2026, triggering the payload required the victim to click the standard preview button once after opening the share link.
By October 17, 2026, the team discovered that marking the code block as previewable caused ChatGPT to open the preview automatically upon navigation. In tests across separate accounts, the exploit executed without any user interaction beyond opening the URL, executing the payload roughly 4.5 seconds after page load. To address potential timing discrepancies between the loading of the graph and the preview frame, the carrier script periodically resent its postMessage payloads until the receiver registered them.
Once active in the victim's session, the injected script gained access to ChatGPT's authenticated frontend APIs. In controlled tests, Parameter Labs used the payload to query the backend conversation endpoint, enumerate recent chats, fetch message contents from a separate private conversation, and transmit a small excerpt to an external server using an image request. Because the script ran with the privileges of the active session, the researchers stated an attacker could perform virtually any action available to the user.
Timeline, Remediation, and Bounty Discussion
Parameter Labs first identified the MathLive message-to-HTML path on October 13, 2026, and submitted their complete report to OpenAI's bug bounty program on October 18, 2026. The researchers added a controlled private-chat disclosure proof the following day.
According to Parameter Labs' write-up timeline, OpenAI reproduced the vulnerability on October 21, 2026, upgrading its triage status from P2 to P1. OpenAI began deploying mitigations across two frontend versions on October 22, introduced CSP adjustments on October 23, and confirmed on October 26 that both web versions rejected the cross-frame MathLive messages.
OpenAI awarded Parameter Labs a $5,000 bug bounty for the report. Industry commentators, including Willison, observed that the payout appeared conservative given the severity of an exploit chain capable of compromising private accounts via a standard shared link.
Parameter Labs stated that all demonstrations took place between accounts under their direct control, and no evidence indicates the vulnerability was exploited against regular users prior to the patch. Because OpenAI remediated the flaw directly on the web application, users are not required to update software, clear browser storage, or reset account credentials.
Questions people ask
Did victims need to take any action besides opening the link?
No. In the final version of the exploit chain documented by Parameter Labs, simply opening the malicious public share link in a signed-in browser was sufficient to trigger automatic execution.
What data could an attacker access using this vulnerability?
The injected code ran within the authenticated chatgpt.com session, allowing it to call backend APIs, enumerate conversation lists, retrieve private chats, and transmit data to an external server.
Has OpenAI fixed the security issue?
Yes. OpenAI deployed fixes across both affected web frontend versions by October 26, 2026, ensuring that untrusted cross-frame messages to the MathLive library are rejected.
Do ChatGPT users need to change passwords or take defensive steps?
No action is required from users. The fix was implemented directly on OpenAI's web servers, and the researchers observed no real-world abuse outside of controlled security testing.
Sources
- How We Took Over ChatGPT AccountsSimon Willison’s Weblog
- Do the Math: How We Took Over ChatGPT AccountsParameter, Oct 28, 2026
- A shared ChatGPT link could act as the person who opened itZeroDay Times, Oct 31, 2026
- ChatGPT Shared-Link Flaw Exposed Private Chats Before OpenAI Fix - The 420.inThe 420.in, Oct 31, 2026
- ChatGPT Shared-Link Flaw — one click ran attacker code in the victim's session — Parameter | AI/TLDRai-tldr.dev, Oct 31, 2026
How this story was made: the newsroom picked it up from Techmeme and simonwillison.net, gathered the full text of the sources above, and drafted it with AI assistance. Every factual claim was then checked against those sources before publishing (26 claims checked). Illustrations marked as AI-generated are not photographs. Spotted an error? Tell us.
Published November 1, 2026 at 07:46 UTC
