TL;DR
Get business pricing on networking and server gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
Security researchers at Parameter reported that a malicious ChatGPT conversation share could run JavaScript in a recipient’s signed-in session and access private chats. OpenAI fixed the issue on October 26, 2026, and classified the report as P1, according to Parameter. The report does not establish whether anyone exploited the flaw outside the researchers’ tests.
Security researchers at Parameter say they found a flaw that let a malicious ChatGPT conversation share run JavaScript in the signed-in session of anyone who opened it, potentially exposing private chats and allowing account actions. Parameter says OpenAI fixed the issue on October 26, 2026 and classified its report as P1; the researchers say opening the shared link was the only action required from a recipient.
According to Parameter’s report, an attacker could create a conversation containing an interactive graph and an HTML Preview, publish the conversation through ChatGPT’s ordinary sharing feature, and send the resulting public link to a target. The researchers say the recipient did not need to install an app, join a project, paste code, or open developer tools. The risk arose when the Preview’s code crossed into the main chatgpt.com page, where it could act within the recipient’s authenticated session.
Parameter says its test payload could enumerate a victim’s conversation list, retrieve material from a private conversation that had not been shared with the researchers, and send that data to an external server. It also described the flaw as enabling actions through ChatGPT’s authenticated APIs. These are findings reported by Parameter; the source material does not include independent validation or evidence that an outside attacker used the technique against users.
The report traces the chain to two features: ChatGPT’s HTML Preview and a graph that loaded the MathLive library. Parameter says MathLive’s message listener accepted a layout update without checking the sender’s origin in the relevant configuration. It then rendered the supplied layout as HTML in the main page. A frame inserted during that process was not sandboxed, the researchers say, allowing code to run with the page’s chatgpt.com identity. The account-access result depended on this chain of weaknesses, rather than on a public share being inherently unsafe.
The reported issue matters because it placed the security boundary at the point where a person opened an ordinary-looking shared conversation. If Parameter’s account is accurate, a link that appeared to display someone else’s chat could have enabled access to data and actions available to the viewer’s signed-in account. That makes the finding relevant to users who handle sensitive material in ChatGPT, including private conversations and files.
The case also illustrates how individually useful web features can interact in unexpected ways. A restricted preview may be designed to keep code separate from the main page, while a separate library supports interactive content. Parameter says the combination allowed an untrusted message to reach a renderer in the authenticated page. The report therefore points to the importance of checking message origins and carefully handling HTML at boundaries between embedded content and the host application.
OpenAI’s reported fix limits the immediate concern, but the source material does not state whether users need to take any specific action, such as changing passwords or reviewing account activity. Readers should distinguish the researchers’ demonstrated capability from evidence of real-world compromise: the report describes a proof of concept, not a confirmed campaign affecting users.
Products Worth Considering
Logitech MX Brio Ultra HD 4K Webcam, Graphite
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
Bose QuietComfort True Wireless Noise-Cancelling Earbuds, Black
As an affiliate, we earn on qualifying purchases.
How the Preview Chain Worked
ChatGPT’s Preview feature can display a working webpage generated from an HTML code block. Parameter says this content ran in a frame on a different web address, a browser isolation measure intended to stop it from directly reading the main ChatGPT page. The researchers initially found that the Preview could not inspect the parent document through ordinary page access.
The reported route around that boundary involved postMessage, a standard browser mechanism for communication between frames. Parameter says MathLive, loaded by the graph, listened for messages that changed the virtual keyboard layout. In the configuration they examined, the listener did not verify the message’s origin or require an approved sender. The Preview could therefore send a message that supplied HTML, which MathLive rendered in the main page.
Parameter says the researchers then used an unsandboxed srcdoc iframe to obtain script execution in a document identified with chatgpt.com. The report also describes a later step involving ChatGPT’s content security policy and YouTube’s oEmbed endpoint, which accepted scripts from a permitted domain. The supplied source ends partway through that technical explanation, so it does not provide the full account of that final bypass or all details of the proof of concept.
“Opening the shared link was the only required action.”
— Parameter
What the Report Does Not Establish
The supplied report does not say whether the vulnerability was exploited by anyone other than Parameter’s researchers, how many users may have opened malicious links, or whether any accounts were actually compromised. It also does not provide an independent technical assessment, an OpenAI statement, or details of the fix beyond the reported date and P1 classification.
The technical excerpt provided here ends during the discussion of the YouTube JSONP technique. It is therefore not possible from this material alone to evaluate every step of the exploit chain, its prerequisites, or the precise scope of affected ChatGPT features and accounts. The claim that the flaw allowed account takeover should be understood as Parameter’s characterization of what its proof of concept could do, not as evidence that attackers took over accounts in the wild.
OpenAI’s Fix and Remaining Questions
Parameter says OpenAI fixed the issue on October 26, 2026, after receiving a report classified as P1. The supplied source does not specify when the vulnerability was reported, what code or configuration OpenAI changed, or whether the company issued user guidance. Those details would clarify how the vulnerable interaction was blocked and whether any follow-up review is needed.
Further confirmation from OpenAI could address the affected versions or features, the scope of the remediation, and whether the company found evidence of exploitation. Until those details are available, the established account is limited: Parameter says it demonstrated a route from a public conversation share to code running in a recipient’s authenticated session, and says OpenAI patched the flaw. Evidence of broader abuse remains unreported in the provided material.
Key Questions
What did the ChatGPT vulnerability reportedly allow?
Parameter says a malicious shared conversation could run JavaScript in a recipient’s signed-in session. Its researchers report that their payload could list conversations, retrieve content from a private chat, send data externally, and call authenticated ChatGPT APIs.
Did a user have to download or install anything?
According to Parameter, no. The researchers say opening the public share link was sufficient to trigger their proof of concept; the recipient did not need to install an app, join a project, paste code, or use developer tools.
Has OpenAI fixed the issue?
Parameter says OpenAI fixed the vulnerability on October 26, 2026, and classified the report as P1. The source material does not include OpenAI’s own confirmation or explain the technical changes made.
Is there evidence that attackers used this flaw against users?
The supplied report does not establish real-world exploitation or confirmed account compromises. It describes what Parameter’s researchers say they demonstrated in a test.
Source: parameter.ai
