On October 28, 2026, security firm Parameter disclosed that a crafted public ChatGPT conversation could run attacker-controlled JavaScript in a visitor’s signed-in session. Parameter said OpenAI fixed the flaw on October 26. In a controlled test, researchers accessed content from a private conversation; Parameter reported no real-world exploitation. (Parameter)
What the test showed, and whether the flaw was fixed
Parameter’s test used separate accounts. Researchers enumerated recent conversations, retrieved content from a private conversation that had not been shared with them, and sent a selected portion to a server they controlled. Those were the demonstrated results; Parameter’s broader description of what code might do in a signed-in session was a potential capability, not a record of every account action being tested.
The visitor’s interaction depended on the version Parameter reproduced. Its more stable version required opening the shared conversation and clicking Preview once. A later version opened Preview automatically, so opening the link alone was sufficient.
Parameter said that by October 26, both affected ChatGPT web-front-end versions rejected the cross-frame messages used in its report, and OpenAI marked the issue resolved. The Hacker News reported that users did not need to install or reset anything. Parameter also reported a $5,000 bug-bounty award for the disclosure.
How the exploit crossed ChatGPT’s frame boundary
The reported chain began with a shared conversation containing a graph and a Preview. These loaded MathLive, a math-rendering library, in the main ChatGPT page. A listener in MathLive accepted a message from another browser frame without checking who sent it, and the message could contain raw HTML.
That HTML created an unsandboxed frame treated as part of ChatGPT’s site. A sandbox normally limits what embedded content can do; without that boundary, the injected JavaScript ran in the signed-in site context. Parameter said a YouTube oEmbed response provided the final script-loading workaround under the applicable content security policy. YouTube was part of that workaround, not the cause of the flaw.
Parameter’s research and OpenAI response timeline
Parameter said it confirmed the message-to-HTML path in ChatGPT’s production code on October 13, 2026, and reproduced arbitrary JavaScript execution through the interface on October 14. It confirmed delivery through public shares between separate accounts on October 16, then reproduced automatic Preview on October 17.
Parameter submitted its report to OpenAI on October 18 and added the private-conversation proof on October 19. According to Parameter, OpenAI reproduced the issue and raised its severity from P2 to P1 on October 21. On October 22, Parameter said OpenAI reported that one front end had been fixed while work continued on the second. Parameter described content-security-policy changes on October 23, followed by the October 26 resolution across both front ends.
