ChatGPT Account Takeover via Shared Link
Original: We Took over ChatGPT Accounts
Why This Matters
XSS-via-third-party-library in AI chat shows share features are a growing attack surface.
Parameter Labs disclosed a P1 vulnerability in ChatGPT where opening a shared link let attackers run JavaScript in a victim's authenticated session, read private chats, and call APIs. OpenAI fixed it Oct 26, 2026.
In October 2026, security researchers at Parameter Labs found a way to hijack any ChatGPT account by sending the target a single shared-conversation link. No app installs, no code execution by the victim—just opening the link was enough.
The attack chained two seemingly innocuous ChatGPT features: the HTML Preview renderer and an interactive graph that loaded the MathLive math library. ChatGPT correctly sandboxes Preview code in a separate origin, blocking direct DOM access to the parent chatgpt.com page. But the graph's inclusion of MathLive also installed a postMessage listener on the main page—a browser API designed for cross-frame communication.
The critical flaw: MathLive's listener didn't validate the sender's origin before accepting a 'virtual keyboard layout update' message. That layout field accepted arbitrary HTML. The sandboxed Preview exploited this by firing two postMessages: one injecting a malicious keyboard layout, one triggering MathLive to render it—pushing attacker-controlled JavaScript into the authenticated parent page.
Once running in chatgpt.com's signed-in context, the payload could enumerate conversation lists, pull content from private chats the attacker had never seen, and exfiltrate data to an external server. It could also call any authenticated ChatGPT API on the victim's behalf.
OpenAI classified the report as P1 severity and patched the vulnerability on October 26, 2026.