Security team Parameter has published details of a now-fixed ChatGPT attack chain. An attacker sends an ordinary shared-conversation link; when the victim opens it while logged in, the attacker's JavaScript runs inside their chatgpt.com session. In testing, the researchers listed the victim's recent conversations, read a private conversation that had never been shared, and sent a small amount of data to an external server.
The whole thing required no app installation, no third-party plugin connection and no developer tools. OpenAI confirmed the fix on October 26 and classified the flaw as P1.
Two well-isolated features, joined by one keyboard
ChatGPT's HTML preview runs on a separate, isolated domain and by design cannot touch the main page. The trouble lay in the interactive graphics inside conversations: they load the math-input library MathLive, which installs a listener on the main page that receives virtual-keyboard messages.
Parameter's report breaks the flaw down into several layers:
- The listener does not check where a message comes from, so a preview running on the isolated domain can send messages to it
- A message can change the keyboard layout, the layout can carry HTML, and that HTML is ultimately written into the main page
- The function meant to "sanitize" the content actually only marks the string as trusted
- The newly inserted iframe has no sandbox attribute, so it inherits chatgpt.com's identity
- The content security policy allows YouTube scripts, and the researchers used one of its callback interfaces to get around it
An early version also required the victim to connect the researchers' ChatGPT App first. Later, they placed the graphic and the malicious preview in the same public conversation, so the share feature alone was enough to deliver the attack. The report also published some request details, which are not repeated here.
As for what the attack achieved, the report demonstrated reading conversations and sending data out. The claim that an attacker could "perform any action on the victim's behalf" is an inference the researchers drew from the front-end authentication endpoint, not something they demonstrated item by item.
An eight-day timeline
The report is highly detailed. The MathLive path was confirmed on October 13, cross-account and cross-workspace reproduction was achieved on the 16th, and the finding was submitted to OpenAI's bug bounty program on the 18th. OpenAI reproduced it on the 21st and raised the severity from P2 to P1, on the 22nd said one front end was fixed and the other still being updated, and on the 23rd first adjusted the content security policy to block part of the chain.
ChatGPT's web app runs two front-end versions at the same time, so the fix also came in two steps.
Account takeover is not a first
Sharing, plugins, caching: most of ChatGPT's past account-takeover bugs have sat at the edges of the main flow. In 2023, researcher Nagli used web cache deception to obtain an access token, again needing only one click on a link from the victim; in 2024, Salt Labs disclosed a redirect problem in the plugin authorization flow. This time the entry point is a third-party library used for rendering content.
MathLive itself has had trouble before. The US National Vulnerability Database lists a cross-site scripting flaw in it, CVE-2025-29049, affecting version 0.103.0 and earlier. That entry does not mention virtual-keyboard messages, and there is no sign that the two are directly related.
Ordinary users do not need to do anything for now. The report does not say whether this chain was ever exploited in the wild, and OpenAI has not issued a separate announcement about it; we could not verify whether there were any victims. One habit is still worth keeping: treat ChatGPT share links from strangers like any other web link.
The report's closing advice to developers is plain: for cross-window messages, check both the origin and the sending window, do not let configuration options carry raw HTML, and treat a content security policy only as a fallback defense.
Sources: CocoLoop, Parameter security research report, US National Vulnerability Database; fix progress and bounties follow the research team's disclosure, and OpenAI has not made a separate announcement.