TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researchers at Parameter reported that a malicious ChatGPT shared conversation could run JavaScript in a recipient’s signed-in session and access private conversations. OpenAI fixed the flaw on Oct. 26, 2026, and classified the report as P1, according to Parameter.
Security researchers at Parameter reported that a crafted ChatGPT shared conversation could run attacker-controlled JavaScript inside the signed-in session of anyone who opened it, allowing access to private conversations and account functions. Parameter says it reported the issue to OpenAI, which fixed it on Oct. 26, 2026, and classified the report as P1.
According to Parameter, an attacker could create a conversation containing a graph and an HTML Preview, publish it through ChatGPT’s standard sharing feature, and send the resulting link to a target. The recipient did not need to install an app, join a project, paste code or use developer tools; opening the shared link was the only action required, the researchers said.
Parameter says it confirmed that the code could enumerate the recipient’s conversation list, retrieve material from a private conversation never shared with the attacker, and send that information to an external server. The researchers also reported that the code could make authenticated requests to ChatGPT’s APIs as the recipient. Those are claims in Parameter’s technical report; the available source material does not include an independent reproduction or a detailed account from OpenAI.
The reported chain crossed a security boundary between an HTML Preview, which ChatGPT placed in a restricted frame, and the main chatgpt.com page. Parameter traced the route to a message listener installed by the MathLive library used with an interactive graph. The listener accepted a message that changed the virtual keyboard layout without checking that it came from an approved origin, the researchers wrote. MathLive then rendered supplied markup in the main page.
The report describes a risk in an ordinary sharing workflow: a recipient could be exposed simply by opening a link, rather than by downloading a file or entering credentials on a fake sign-in page. If exploited as Parameter describes, code running in the authenticated site could reach information and actions available to the signed-in user. That makes the issue relevant to people who use ChatGPT for private conversations, uploaded files or other sensitive work.
The account-access claim depends on the reported code executing within chatgpt.com’s security context. Parameter says its test reached authenticated APIs and private conversation content. The report does not establish that attackers used the flaw against real users, or that any user data was stolen. Those distinctions matter: a demonstrated vulnerability can pose a serious risk without proving that the risk was exploited in the wild.
The incident also shows how separate features can interact in unexpected ways. The Preview’s isolation appeared to prevent it from reading the surrounding page, but a message channel connected it to a listener installed for another feature. The weakness, as described, lay not simply in allowing code in a Preview, but in how the receiving component handled messages and rendered their contents.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Logitech MX Brio Ultra HD 4K Webcam, Graphite
As an affiliate, we earn on qualifying purchases.
The Preview and Message Listener
ChatGPT’s HTML Preview lets users render code blocks as small webpages. Parameter says the Preview ran in a frame on a different web address, which ordinarily prevented its code from reading the main page’s document. The researchers began by examining what the Preview could still communicate with, rather than assuming the frame could directly inspect the signed-in page.
The report says an interactive graph loaded MathLive, which added a listener in the main ChatGPT page for messages used to control an on-screen keyboard. The Preview could send messages across the frame boundary using the browser’s postMessage mechanism. In Parameter’s account, the listener did not check the sender’s origin for the relevant setting and accepted markup as a keyboard layout.
Parameter further says MathLive inserted a frame built with srcdoc without a sandbox attribute. The researchers describe using that route, along with a permitted external script source, to get JavaScript execution despite ChatGPT’s Content Security Policy blocking inline scripts. The supplied report excerpt describes this part of the chain but does not provide a complete account of every step or evidence beyond the researchers’ own findings.
“Opening the shared link was the only required action.”
— Parameter
What the Public Report Leaves Open
The available source material does not say whether anyone exploited the flaw against real ChatGPT users, whether any accounts or data were compromised, or how many users may have been exposed before the fix. Parameter reports successful testing, but no independent technical analysis or OpenAI statement is included here to corroborate the details.
The report says OpenAI fixed the issue and assigned a P1 classification, but it does not specify which code changes closed the chain, whether related features were separately reviewed, or whether the fix was deployed to all users at the same time. It also does not provide details about OpenAI’s investigation into possible exploitation or user notification. These points remain unconfirmed in the supplied material.
Verification and Security Follow-Up
The immediate next step is to establish the scope of the remediation and whether there is evidence of exploitation. OpenAI’s own technical account, if released, could clarify what changed, how the vulnerability was tested, and whether any user data was affected. Parameter’s report says the issue was fixed on Oct. 26, 2026; it does not describe a further planned disclosure or a follow-up investigation.
Until more information is available, readers should distinguish the reported capability from confirmed harm: Parameter says its test reached private content and authenticated account functions, but the source does not show that attackers used the flaw against customers. Users who encountered suspicious shared conversations can review account activity and follow any guidance from OpenAI, while recognizing that the supplied report does not identify a specific user action required after the fix.
Key Questions
What did the reported ChatGPT flaw allow?
Parameter says a malicious shared conversation could execute JavaScript in a recipient’s signed-in ChatGPT session, access private conversation content and call authenticated APIs. These findings are attributed to the researchers’ report.
Did a recipient have to install anything?
No installation was needed, according to Parameter. The researchers say opening the public share link was sufficient for the reported chain to run.
Has OpenAI fixed the issue?
Parameter says OpenAI fixed the flaw on Oct. 26, 2026, and classified its report as P1. The supplied source does not include a separate statement from OpenAI detailing the fix.
Is there evidence that users were attacked?
The supplied report describes what Parameter says it confirmed in testing. It does not establish that the flaw was exploited against real users or that customer data was stolen.
How did the exploit cross the Preview boundary?
Parameter says a listener associated with MathLive accepted a cross-frame message carrying a keyboard layout and rendered the supplied markup in the main ChatGPT page. The researchers say this created a route from the restricted Preview into the signed-in site.
Source: parameter.ai
