Do I need to update anything to be safe from the ChatGPT share link flaw?

No update is needed, because OpenAI fixed the flaw inside its own web frontends on October 26, 2026. Both frontend versions now reject the cross-frame MathLive messages the exploit depended on. ChatGPT runs as a hosted service, so the change reached every user at once. Parameter describes the content security policy tightening as defense in depth rather than the root fix.

What could an attacker read with the ChatGPT share link exploit?

Parameter reports that the injected script read the session token from the page, called ChatGPT's conversation APIs, and pulled content from a private chat the attacker had never been given access to. A small piece of that data was then sent to an external server through an image request. Parameter summarises the outcome as taking over the victim's account.

Was the ChatGPT share link flaw a prompt injection?

Prompt injection played no part in this chain. Parameter describes a conventional web flaw: a postMessage listener in the MathLive keyboard library accepted messages from any frame, and its output reached innerHTML without sanitising. Treating an AI product as a web application, and not only as a model, is what exposed the path to running code under the chatgpt.com origin.

MEDVulnerability

ChatGPT: a shared chat link could run code and read private chats

Opening one ChatGPT share link was enough to leak a visitor's private conversations, because a math keyboard trusted messages from any frame.

October 28, 2026 · Parameter · Research by Mukul Goyal

ChatGPT

MEDVulnerability

A public ChatGPT share link could run attacker JavaScript as chatgpt.com in any signed-in visitor's session and read their private conversations. OpenAI fixed both web frontends on October 26, nine days after Parameter reported it.

01What happened

Parameter published the chain on October 28, 2026, two days after OpenAI resolved it. Mukul Goyal and the Parameter research team reported the issue to OpenAI's bug bounty program on October 18, 2026. OpenAI reproduced it, raised the rating from P2 to P1 on October 21, and paid a 5,000 dollar bounty.

02How it works

The chain abuses a postMessage listener that MathLive, the math keyboard library loaded by ChatGPT's interactive graphs, installs in the main page. MathLive checked neither the sender's origin nor the source window, and its createHTML helper passed input straight to innerHTML, so a later HTML Preview could replace the keyboard layout with attacker markup. That markup created an iframe with srcdoc and no sandbox attribute, which inherited the chatgpt.com identity. ChatGPT's content security policy blocked inline scripts but allowed YouTube, so a YouTube oEmbed JSONP callback supplied the code execution.

03Who is affected

The flaw sat in the ChatGPT web frontend, in the interaction between public conversation sharing, HTML Preview and the MathLive virtual keyboard. Any signed-in ChatGPT web user who opened an attacker's share link was exposed, across both frontend versions OpenAI was running at the time.

04What to do

No user action is needed, because OpenAI fixed the issue server side on October 26, 2026 and both web frontends now reject the cross-frame MathLive messages. Teams that treat a shared ChatGPT link as harmless should note that the link ran inside the visitor's own authenticated session.

Questions people ask

Do I need to update anything to be safe from the ChatGPT share link flaw?: No update is needed, because OpenAI fixed the flaw inside its own web frontends on October 26, 2026. Both frontend versions now reject the cross-frame MathLive messages the exploit depended on. ChatGPT runs as a hosted service, so the change reached every user at once. Parameter describes the content security policy tightening as defense in depth rather than the root fix.
What could an attacker read with the ChatGPT share link exploit?: Parameter reports that the injected script read the session token from the page, called ChatGPT's conversation APIs, and pulled content from a private chat the attacker had never been given access to. A small piece of that data was then sent to an external server through an image request. Parameter summarises the outcome as taking over the victim's account.
Was the ChatGPT share link flaw a prompt injection?: Prompt injection played no part in this chain. Parameter describes a conventional web flaw: a postMessage listener in the MathLive keyboard library accepted messages from any frame, and its output reached innerHTML without sanitising. Treating an AI product as a web application, and not only as a model, is what exposed the path to running code under the chatgpt.com origin.

Sources 2 links, all fetched

1parameter.aiParameter Write-Up
2thehackernews.comThe Hacker News