ChatGPT shared chat link could run attacker code in the victim’s session and read private chats (fixed, no CVE)

What happened

Mukul Goyal of Parameter found a chain that ran attacker-controlled JavaScript as chatgpt.com in a signed-in victim’s browser. The victim only had to open a public ChatGPT share link (Parameter). The steps:

1. The shared conversation held an interactive graph. Drawing it loaded the MathLive math library into the main ChatGPT page, which added a postMessage listener.
2. The same conversation held an HTML Preview. Preview runs in a sandboxed frame on a separate origin. The sandbox held, but the frame could still send messages to the main page.
3. MathLive accepted a message that changed its virtual keyboard layout without checking the sender’s origin or source window. The layout could carry raw HTML, which went into the page through innerHTML without sanitising.
4. That HTML created an iframe with no sandbox attribute. Because the main page made it, the frame ran as chatgpt.com.
5. ChatGPT’s Content Security Policy blocked inline scripts but allowed YouTube. A YouTube oEmbed JSONP callback returned attacker-chosen JavaScript, and the browser ran it.

The victim clicked Preview once in the stable version. In a later version Preview opened automatically, so opening the link was enough (Parameter).

Impact. The code ran with the victim’s signed-in access. In the proof of concept it listed recent conversations, opened a private chat never shared with the attacker, and sent part of it to the researchers’ server. The researchers say the same code could do anything the normal front end can do, which amounts to account takeover. They did not demonstrate every action (Parameter).

Timeline. Parameter reported it on 18 October. OpenAI reproduced it on 21 October and raised it from P2 to P1. One web front end was fixed on 22 October and CSP changes blocked part of the chain on 23 October. By 26 October both front ends rejected the messages. OpenAI paid a $5,000 bounty (Parameter). Parameter published on 28 October, after the fix (The Hacker News).

No exploitation outside the research has been reported. The private-chat test used the researchers’ own accounts (The Hacker News).

Am I affected?

As a ChatGPT user: no action is needed. The fix is server-side (The Hacker News). Whether anyone used the chain against real users before 26 October is not disclosed.

As a developer: you have the same class of bug if your app loads MathLive on a page that can receive messages from a frame you do not fully control. MathLive 0.111.2, released on 31 October, changed virtual keyboard, proxy and mathfield messages to “default to same-origin validation” and binds state-changing messages to the connected mathfield window (MathLive changelog). The changelog does not mention ChatGPT or Parameter.

# Which MathLive version does your project resolve?
npm ls mathlive

# Message listeners to review for origin and source checks
grep -rnE "addEventListener\(\s*['\"]message['\"]" --include='*.js' --include='*.ts' --include='*.tsx' src/

What to do now

1. Update MathLive to 0.111.2 or later if you ship it (MathLive changelog).
2. Check both event.origin and event.source in every message listener that changes state. Parameter’s write-up names this as the first fix (Parameter).
3. Never let cross-window settings carry raw HTML, and keep any document you create dynamically sandboxed when an untrusted frame can influence its content (Parameter).
4. Look for script hosts in your CSP that serve JSONP. An allowed host with a JSONP endpoint, like the YouTube oEmbed callback here, turns any HTML injection into script execution.

Why this matters

No single part was badly broken. The sandbox held. The bug lived in the gap between sharing, Preview, a third-party math library and the CSP, and only showed up when all of them ran on the same page. Parameter’s advice is to test features together, not one at a time (Parameter).

Sources

• Parameter: We found a gap at OpenAI
• The Hacker News: A shared ChatGPT link could run attacker code
• MathLive changelog (0.111.2)