In October 2026, researchers discovered a critical vulnerability in ChatGPT that allowed attackers to hijack user accounts through shared conversations. By combining two seemingly harmless features—a graph and an HTML Preview—attackers could inject malicious JavaScript that executed within the victim’s authenticated session. When a user opened a shared link, the payload gained access to their private chats, files, and account settings without requiring any installation or developer tool access. The exploit leveraged Math Live’s insecure message-handling system, which failed to verify message origins, enabling cross-frame communication between the Preview and the main ChatGPT interface. OpenAI fixed the issue on October 26, classifying it as a P1 (critical) severity. The attack required no user interaction beyond opening the shared link, making it a severe threat to account security.
The vulnerability stemmed from the interaction between ChatGPT’s Preview feature, which runs HTML in an isolated frame, and the Math Live library used for rendering graphs. Math Live installed a postMessage listener on the main page that accepted layout updates from any origin. By sending crafted messages from the Preview frame, attackers could inject HTML into the virtual keyboard, which then rendered in the context of chatgpt.com. This allowed full API access as the victim, including reading private conversations and exfiltrating data to external servers.
Source: Hacker News · Summarized by HeadlinesBriefing