Critical ChatGPT Flaw Allowed Attackers to Hijack Accounts and Steal Private Conversations With One Link

What happened?

A critical ChatGPT flaw that let a malicious shared conversation run attacker-controlled JavaScript in another user’s signed-in session. The attack could list private chats, read conversations never shared with the attacker, and send stolen data to an outside server. Opening one crafted link was enough in the final demonstration. OpenAI fixed the issue on October 26, 2026, according to Parameter’s technical disclosure, published by Mukul Goyal on October 28. The company classified the report as P1 and awarded a $5,000 bounty.

Key details

• A critical ChatGPT flaw allowed a malicious shared conversation to run attacker-controlled JavaScript in a victim's signed-in session.
• MathLive accepted keyboard changes without properly checking the sender's origin or requiring an approved source window.
• Attackers injected HTML through innerHTML via a helper called createHTML that did not remove unsafe markup.
• An iframe using srcdoc inherited ChatGPT's web origin and could access the parent page because it lacked sandbox restrictions.
• YouTube's oEmbed endpoint returned an attacker-supplied JSONP callback as JavaScript, bypassing Content Security Policy.
• The final exploit opened automatically when a victim clicked a crafted link, executing after roughly 4.5 seconds.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.