Researchers Expose ChatGPT Share-Link Account Takeover

On October 28, 2026, security researchers reported that a public ChatGPT share link could execute attacker-controlled JavaScript inside the signed-in session of anyone who opened it. The attack let them enumerate private conversations, retrieve messages from a conversation that had never been shared with them, and send selected data to an external server. The victim only needed to open the link; in one tested version, the page ran the payload automatically after about 4.5 seconds. OpenAI fixed the issue on October 26, classified it as P1 and awarded the researchers a total bounty of $5,000.

The exploit combined ChatGPT’s HTML Preview and interactive graph features. Preview code ran in a restricted frame on a different web address, where it could not directly read the main ChatGPT page. But the graph loaded MathLive, a math-input library, which installed a message listener in that main page. The listener accepted messages without checking which web address or window sent them, and allowed a message to supply HTML for the virtual keyboard. The Preview could send messages that replaced the keyboard layout, crossing the boundary between the isolated frame and the signed-in page.

When MathLive displayed the supplied layout, it inserted the HTML into ChatGPT’s page. The researchers used an embedded frame with `srcdoc` (an attribute that supplies a frame’s HTML directly) to create a document without a sandbox, giving its code the `chatgpt.com` identity. ChatGPT’s Content Security Policy, or CSP (rules that restrict which page resources can run), blocked inline JavaScript but allowed scripts from YouTube. The researchers exploited YouTube’s oEmbed endpoint, which returned a JSONP-style response: JavaScript containing a callback. Its error response still included the callback, allowing code to run inside the new frame.

Early tests required a researcher-controlled ChatGPT App. The researchers later placed a genuine graph and an assistant-authored HTML Preview in one public conversation, so its share link carried both the message listener and the payload. In a stable reproduction the victim clicked Preview once; in a later version Preview opened automatically. The team reproduced that automatic path three times, including after a hard refresh. Because the graph and Preview could load in either order, the payload retried its messages for a limited period.

The researchers said the injected code used the victim’s authenticated session to call ChatGPT’s conversation APIs, rather than merely reading text visible on the screen. They demonstrated retrieving private conversation content and sending a small part of the response to a server they controlled. They described the same access as capable of reaching other actions exposed through ChatGPT’s authenticated frontend APIs. OpenAI reproduced the JavaScript execution and private-conversation proof. Its fix updated both versions of the web frontend to reject the cross-frame MathLive messages. The researchers’ timeline says they confirmed the message-to-HTML path on October 13, submitted their report on October 18, and OpenAI reproduced the issue on October 21, raising its severity from P2 to P1. The company confirmed resolution on October 26.

On October 28, 2026, security researchers reported that a public ChatGPT share link could execute attacker-controlled JavaScript inside the signed-in session of anyone who opened it. The attack let them enumerate private conversations, retrieve messages from a conversation that had never been shared with them, and send selected data to an external server. The victim only needed to open the link; in one tested version, the page ran the payload automatically after about 4.5 seconds. OpenAI fixed the issue on October 26, classified it as P1 and awarded the researchers a total bounty of $5,000.

The exploit combined ChatGPT’s HTML Preview and interactive graph features. Preview code ran in a restricted frame on a different web address, where it could not directly read the main ChatGPT page. But the graph loaded MathLive, a math-input library, which installed a message listener in that main page. The listener accepted messages without checking which web address or window sent them, and allowed a message to supply HTML for the virtual keyboard. The Preview could send messages that replaced the keyboard layout, crossing the boundary between the isolated frame and the signed-in page.

When MathLive displayed the supplied layout, it inserted the HTML into ChatGPT’s page. The researchers used an embedded frame with `srcdoc` (an attribute that supplies a frame’s HTML directly) to create a document without a sandbox, giving its code the `chatgpt.com` identity. ChatGPT’s Content Security Policy, or CSP (rules that restrict which page resources can run), blocked inline JavaScript but allowed scripts from YouTube. The researchers exploited YouTube’s oEmbed endpoint, which returned a JSONP-style response: JavaScript containing a callback. Its error response still included the callback, allowing code to run inside the new frame.

Early tests required a researcher-controlled ChatGPT App. The researchers later placed a genuine graph and an assistant-authored HTML Preview in one public conversation, so its share link carried both the message listener and the payload. In a stable reproduction the victim clicked Preview once; in a later version Preview opened automatically. The team reproduced that automatic path three times, including after a hard refresh. Because the graph and Preview could load in either order, the payload retried its messages for a limited period.

The researchers said the injected code used the victim’s authenticated session to call ChatGPT’s conversation APIs, rather than merely reading text visible on the screen. They demonstrated retrieving private conversation content and sending a small part of the response to a server they controlled. They described the same access as capable of reaching other actions exposed through ChatGPT’s authenticated frontend APIs. OpenAI reproduced the JavaScript execution and private-conversation proof. Its fix updated both versions of the web frontend to reject the cross-frame MathLive messages. The researchers’ timeline says they confirmed the message-to-HTML path on October 13, submitted their report on October 18, and OpenAI reproduced the issue on October 21, raising its severity from P2 to P1. The company confirmed resolution on October 26.