ChatGPT shared-link flaw allowed code execution in logged-in sessions, OpenAI patched
Security firm Parameter found that a crafted ChatGPT share link could run attacker JavaScript as chatgpt.com inside the signed-in session of anyone who opened it. Parameter reported the bug to OpenAI through its bug bounty program on October 18. OpenAI shipped a fix on October 26, eight days later, rated the bug P1 and paid a $5,000 bounty. Parameter published its technical write-up on October 28, after the fix was live.
The attack chained three design weaknesses. ChatGPT's HTML Preview normally isolates shared code in a sandboxed frame on a separate origin. But an interactive graph in a shared conversation loaded the MathLive library into the main page, where its message listener accepted cross-frame messages without origin checks. Keyboard-layout data then carried raw HTML into the page, creating an unsandboxed iframe that inherited the chatgpt.com origin. A YouTube script, permitted by ChatGPT's content security policy, supplied the code that ran.
In the most reliable version, the victim opened the link and clicked Preview once. A later version opened Preview automatically, so the link alone was enough. The code could list recent conversations, read private chats never shared with the attacker, and call authenticated ChatGPT APIs. The fix is on OpenAI's side, and both affected frontend versions now reject the cross-frame messages. No exploitation in the wild was reported in the sources reviewed, and none establishes that an account was compromised.
Why it matters
For any company that lets users share generated content, render third-party HTML or expose chat sessions to embedded widgets, this bug shows how a single weak link can cross a trust boundary. The attacker needed nothing more than a normal share link, and the damage reached the victim's authenticated account rather than a sandboxed preview. Investors and acquirers should expect diligence questions on which components of a product load third-party scripts into the main origin.
The MathLive flaw sat in an open-source dependency whose listener accepted messages without origin validation. Teams that ship chat-style sharing, embeds or previews should review every postMessage listener, sandbox attribute and CSP allowlist entry, and document who owns each one. Those checks are small next to a session-level breach of user data.
Key points
- 1Parameter reported the flaw through OpenAI's bug bounty program on October 18.
- 2OpenAI shipped the fix on October 26, eight days later, and rated the bug P1.
- 3OpenAI paid a total of $5,000 for the report.
- 4The chain relied on a MathLive message listener that skipped origin validation.
- 5The fix covered two versions of ChatGPT's web frontend, and no in-the-wild exploitation was reported.
