# ChatGPT: a shared chat link could run code and read private chats

> Opening one ChatGPT share link was enough to leak a visitor's private conversations, because a math keyboard trusted messages from any frame.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Parameter
- **Disclosed:** 2026-10-28
- **Affects:** ChatGPT
- **Research by:** Mukul Goyal
- **Primary source:** https://www.parameter.ai/labs/we-found-a-gap-at-openai
- **Page:** https://theinjection.dev/items/parameter-chatgpt-share-link-takeover/

A public ChatGPT share link could run attacker JavaScript as chatgpt.com in any signed-in visitor's session and read their private conversations. OpenAI fixed both web frontends on October 26, nine days after Parameter reported it.

## What happened

Parameter published the chain on October 28, 2026, two days after OpenAI resolved it. Mukul Goyal and the Parameter research team reported the issue to OpenAI's bug bounty program on October 18, 2026. OpenAI reproduced it, raised the rating from P2 to P1 on October 21, and paid a 5,000 dollar bounty.

## How it works

The chain abuses a postMessage listener that MathLive, the math keyboard library loaded by ChatGPT's interactive graphs, installs in the main page. MathLive checked neither the sender's origin nor the source window, and its createHTML helper passed input straight to innerHTML, so a later HTML Preview could replace the keyboard layout with attacker markup. That markup created an iframe with srcdoc and no sandbox attribute, which inherited the chatgpt.com identity. ChatGPT's content security policy blocked inline scripts but allowed YouTube, so a YouTube oEmbed JSONP callback supplied the code execution.

## Who is affected

The flaw sat in the ChatGPT web frontend, in the interaction between public conversation sharing, HTML Preview and the MathLive virtual keyboard. Any signed-in ChatGPT web user who opened an attacker's share link was exposed, across both frontend versions OpenAI was running at the time.

## What to do

No user action is needed, because OpenAI fixed the issue server side on October 26, 2026 and both web frontends now reject the cross-frame MathLive messages. Teams that treat a shared ChatGPT link as harmless should note that the link ran inside the visitor's own authenticated session.

## Quick facts

- **Affected:** ChatGPT web frontend
- **Attack type:** Share link to script execution as chatgpt.com
- **Found by:** Mukul Goyal, Parameter
- **Reported:** October 18, 2026
- **Fixed:** October 26, 2026, server side
- **OpenAI rating:** P1, raised from P2
- **Bounty:** 5,000 dollars

## Questions

### Do I need to update anything to be safe from the ChatGPT share link flaw?

No update is needed, because OpenAI fixed the flaw inside its own web frontends on October 26, 2026. Both frontend versions now reject the cross-frame MathLive messages the exploit depended on. ChatGPT runs as a hosted service, so the change reached every user at once. Parameter describes the content security policy tightening as defense in depth rather than the root fix.

### What could an attacker read with the ChatGPT share link exploit?

Parameter reports that the injected script read the session token from the page, called ChatGPT's conversation APIs, and pulled content from a private chat the attacker had never been given access to. A small piece of that data was then sent to an external server through an image request. Parameter summarises the outcome as taking over the victim's account.

### Was the ChatGPT share link flaw a prompt injection?

Prompt injection played no part in this chain. Parameter describes a conventional web flaw: a postMessage listener in the MathLive keyboard library accepted messages from any frame, and its output reached innerHTML without sanitising. Treating an AI product as a web application, and not only as a model, is what exposed the path to running code under the chatgpt.com origin.

## Sources

1. [Parameter Write-Up](https://www.parameter.ai/labs/we-found-a-gap-at-openai)
2. [The Hacker News](https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html)