ChatGPT HTML Preview Flaw Let Shared Links Hijack Accounts

A sandbox escape in ChatGPT's HTML preview feature let attackers take over any account via a single shared link. Parameter Labs detailed how a malicious conversation could execute JavaScript in a victim's signed-in session and exfiltrate private chats. OpenAI fixed the P1 vulnerability after receiving the report on October 18.

• Opening a shared ChatGPT link was the only action required from the victim; no app installation, workspace join, or code paste was needed
• The attack exploited MathLive's virtual keyboard postMessage handler, which used innerHTML without origin validation, allowing sandboxed frames to inject unrestricted iframes
• YouTube's oEmbed endpoint served as the final bypass, reflecting JavaScript that executed despite OpenAI's CSP blocking inline scripts
• Parameter Labs confirmed the payload could enumerate conversations, read private chats never shared with the attacker, and exfiltrate data to external servers
• OpenAI classified the report as P1 (most serious) and deployed a fix on October 26, eight days after the October 18 report

Bottom line If your organization shares ChatGPT conversations, verify the fix has reached your users and treat shared links from untrusted sources as potentially malicious.