A public ChatGPT conversation could be rigged to run an attacker’s code inside the account of anyone who opened it, and from there read private chats that were never shared. OpenAI fixed the flaw on 26 October, and nothing needs updating on your side.
In the final version of the attack, opening the shared link was the only thing the victim had to do. No stolen password was involved: the code ran inside the victim’s own signed-in browser session, so ChatGPT treated its requests as the account owner’s.
The find comes from security firm Parameter, whose researcher Mukul Goyal published the technical write-up on 28 October. Parameter says OpenAI rated the report P1 and patched two builds of the web app.
Two harmless features and a mail slot
The Preview button turns an HTML code block into a live mini page. Since that code is untrusted, ChatGPT keeps it in a walled-off frame served from a different web address, and Parameter found the wall itself held: Preview code could not read the main page around it.
The weak point sat next to the wall. When a conversation includes an interactive graph, ChatGPT loads MathLive, a maths library, and the library starts waiting in the main page for messages about its on-screen keyboard. Browsers let frames pass messages even when they cannot read each other, which Parameter likens to a mail slot. MathLive did not check where a layout-change message came from, and the layout it received could contain HTML.
That HTML was used to open a fresh frame with no sandbox, which the browser counted as part of chatgpt.com. One hurdle remained. ChatGPT’s content security policy bars inline scripts but trusts scripts from YouTube, and YouTube’s oEmbed endpoint pastes whatever callback name it is given into its reply. The researchers fed it their own code, and the browser ran it as if YouTube had sent it.
What the injected code could reach
In Parameter’s proof, the code listed the victim’s recent conversations, fetched a private one unrelated to the shared link, and sent a small piece of it to a server the researchers controlled. Parameter says the same access could reach other things the web app exposes, such as account actions, since the code ran with the page’s own authentication.
The most stable early version needed the victim to click Preview once. Parameter then marked the HTML block so it opened by itself, and reports three clean runs in a separate account, each showing the test alert after roughly four and a half seconds. The graph and the Preview had to sit in one public conversation, and the share link carried the whole chain, so an attacker could send it by email, chat or a social post.
The fix lives on OpenAI’s servers. Parameter’s advice to developers is that code receiving cross-frame messages must check both who sent them and which window they came from, and that content shaped by an untrusted frame should stay sandboxed all the way through rendering. For everyday users, the sensible habit is unchanged: be wary of shared chat links from people you do not know.
