In October 2026, security researchers at Parameter found that an ordinary public ChatGPT share link could run attacker-controlled JavaScript inside the signed-in session of anyone who opened it. No app install, no project invite, no developer tools and no flaw in OpenAI's login flow were needed. Opening the link was the only required action. Once the payload executed as chatgpt.com, it could list the victim's conversations, read a private chat that had never been shared with the attacker and send that content to an external server, which amounts to taking over the account.
The chain combined two features that look harmless on their own. ChatGPT's HTML Preview keeps untrusted code in a sandboxed frame on a separate origin, and that isolation held: the Preview could not read the main page. But the same conversation also loaded an interactive graph, which pulled in a math library called MathLive. MathLive had installed a message listener in the main ChatGPT page that accepted cross-frame messages from any origin and rendered the supplied keyboard layout as raw HTML. That HTML created a new iframe without sandbox restrictions, inheriting the chatgpt.com identity, and a Content Security Policy allowance for YouTube scripts supplied the last step of execution.
Parameter reported the issue on October 18. OpenAI reproduced it on October 21, raised the severity from P2 to P1 and shipped fixes across both web frontends by October 22. On October 26 it confirmed that both frontends rejected the cross-frame MathLive messages and paid a 5,000 dollar bounty. Parameter's guidance is blunt: verify both the sender's origin and the exact target window before acting on a message, keep raw HTML out of cross-window settings, keep dynamically created documents sandboxed, and treat a content security policy as a safety net rather than the barrier.