ChatGPT Share Link Flaw Allowed Unauthorized Access to Private Conversations

Security researchers have disclosed a vulnerability involving shared ChatGPT conversation links that could allow arbitrary code execution within an active user session, potentially exposing private chat histories. The issue, discovered by security firm Parameter, was submitted to OpenAI through its bug bounty program and subsequently resolved.

Understanding the Vulnerability

The security flaw stemmed from how ChatGPT processed specific interactions within shared public conversation links. According to the researchers, an attacker could craft a shared chat link distributed via standard channels such as email or direct messaging.

In initial testing phases, exploiting the mechanism required the recipient to open the link and click a "Preview" button within ChatGPT. In subsequent iterations of the proof-of-concept, the attack vector was refined so that simply opening the link initiated the sequence without additional user interaction.

Once triggered, the injected code executed within the context of the victim's authenticated session, granting access to underlying ChatGPT APIs. This allowed the demonstration to list recent conversations, access unshared private chats, and transmit selected data to an external server controlled by the researchers. Parameter emphasized that the exercise was a controlled test conducted between separate accounts and found no evidence of real-world exploitation.

The technical chain relied on the interaction of two platform features:

• The Preview Feature: ChatGPT allows certain blocks of HTML within a conversation to render as a small web page inside a sandboxed frame on a separate web address, keeping it isolated from the main application page.
• The MathLive Integration: A secondary feature within the shared chat loaded a math rendering library called MathLive onto the main ChatGPT page, establishing an event listener intended to manage on-screen keyboard settings.

The vulnerability occurred because the MathLive listener accepted incoming messages regarding keyboard layouts without verifying the origin frame, and permitted those messages to carry raw HTML. This allowed the sandboxed Preview frame to communicate with the primary application page. From there, the injected HTML created a new un-sandboxed frame recognized by the browser as part of chatgpt.com, utilizing a script-loading pathway to execute the attack code.

Response and Resolution

Parameter reported the finding to OpenAI on October 18. OpenAI verified and reproduced the vulnerability, categorizing it as a P1 severity issue—the platform's highest designation.

OpenAI deployed a fix across two versions of the ChatGPT web frontend by October 26, ensuring that the messages enabling the cross-frame interaction are rejected. Parameter publicly released its technical writeup on October 28 following the patch deployment and received a $5,000 bug bounty award.

Practical Implications and Verification

For end users, no manual action, software installation, or password reset is required, as the remediation was implemented entirely on OpenAI's server infrastructure.

• Confirmed Aspects: Parameter confirmed that the vulnerability allowed cross-frame script execution and private conversation access during controlled testing. OpenAI confirmed the findings, raised the severity rating, and deployed a global fix.
• Unknown Aspects: There is no confirmation that malicious actors exploited the vulnerability in the wild prior to the patch.
• How to Verify: Readers can review the technical details and official timeline directly in the disclosure published by Parameter or cross-reference security advisories via OpenAI's official channels and bug bounty communications. For further context, the full technical breakdown is available at The Hacker News.