A vulnerability described by security firm Parameter shows how a malicious ChatGPT share link could, when opened by a logged-in user, run attacker-controlled JavaScript in that user’s authenticated ChatGPT session. The report says this could let an attacker access private data available through ChatGPT’s APIs and potentially take actions on the victim’s behalf.
Across the coverage, the key mechanism involves interactions between multiple ChatGPT web features rather than a single isolated flaw. Parameter’s writeup describes a failure chain in which an iframe-based “HTML preview” sandbox could be used to inject content into the surrounding page through postMessage handling related to MathLive’s virtual keyboard in an interactive graph feature. The report says injected HTML could bypass iframe restrictions, and—after JavaScript execution was achieved—data could be exfiltrated.
OpenAI is described as rating the report P1, paying a $5,000 bug bounty, and shipping a fix (with one account noting a timeline from October 18 to an October 26 patch). One source emphasizes that there’s no evidence of real-world exploitation and that the researchers’ demonstration used their own accounts; another frames the findings as a broader lesson in how defenses can fail when features compose.
