A security vulnerability in ChatGPT allowed attackers to execute malicious code inside the logged-in sessions of users who opened specially crafted shared conversation links, potentially exposing their private chats and enabling actions on their accounts.
Researchers at cybersecurity firm Parameter discovered the flaw and reported it to OpenAI through its bug bounty program on October 18. OpenAI fixed the vulnerability eight days later and assigned it a P1 severity rating, its highest priority category.
The attack used an ordinary ChatGPT shared conversation link, which could be distributed through email, messaging apps, support tickets, or social media. Victims did not need to install software, join a workspace, or authenticate through an attacker-controlled service.
In the most reliable version of the attack, opening the link and clicking ChatGPT’s Preview button once was enough to trigger the exploit. Researchers later modified the attack so that Preview opened automatically, meaning simply visiting the link could initiate the attack.
Once executed, the attacker’s code ran within the victim’s authenticated ChatGPT session, giving it access to the same permissions as the legitimate website. The researchers demonstrated that the exploit could list recent conversations, open private chats that had never been shared, and transmit portions of their contents to an external server.
The code interacted directly with ChatGPT’s authenticated APIs rather than relying on information displayed on the screen. According to Parameter, this potentially allowed attackers to perform actions on behalf of the victim’s account beyond simply reading conversations.
The researchers conducted their tests in a controlled environment using separate accounts. They reported no evidence that the vulnerability had been exploited against real users.
The exploit worked by chaining together several features and security weaknesses in ChatGPT’s web interface. The platform’s Preview feature can render HTML from a conversation inside a restricted frame hosted on a separate origin. This sandbox normally prevents the rendered content from accessing the surrounding ChatGPT page.
However, the researchers discovered that an interactive graph in the same conversation could load a mathematical library called MathLive into the main ChatGPT page. The library installed a message listener that handled keyboard-related messages but failed to verify which browser frame sent them.
The listener also accepted raw HTML as part of the message data. This allowed malicious content inside the Preview frame to cross the sandbox boundary and inject HTML into the trusted ChatGPT page.
The injected HTML created a new frame that inherited the chatgpt.com origin. Researchers then used a script hosted on YouTube to execute code within the victim’s authenticated session. ChatGPT’s content security policy blocked inline scripts but permitted scripts from YouTube, enabling the final stage of the exploit.
Parameter identified three key design weaknesses: the message listener did not validate the sender, the message accepted raw HTML, and the injected HTML could create a frame that inherited ChatGPT’s trusted origin. The YouTube script was only a way to complete the attack, not the underlying vulnerability.
OpenAI reproduced the exploit and its private-conversation access demonstration before deploying fixes across two versions of ChatGPT’s web frontend. By October 26, both versions rejected the malicious messages used in the attack.
Parameter published its technical findings on October 28. OpenAI awarded the researchers a total of $5,000 through its bug bounty program.
ChatGPT users do not need to take any action to address the vulnerability. The security fix was implemented on OpenAI’s side, and no software installation or account reset is required.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Malicious ChatGPT Share Links Could Expose Private Conversations
