---
title: Parameter: a public ChatGPT share link could run attacker JavaScript as chatgpt.com and read the victim's private chats; OpenAI fixed it Oct 26 | ctxsec
url: https://ctxsec.com/items/parameter-chatgpt-share-link-mathlive-postmessage-account-takeover
description: "Parameter Labs chained ChatGPT's HTML Preview, a MathLive postMessage listener with no origin check, an unsandboxed srcdoc iframe and a YouTube JSONP callback allowed by CSP, so opening a shared conversation ran code in the victim's signed-in session. Reported Oct 18, fixed Oct 26, rated P1."
status: "researcher write-up (Parameter Labs, Oct 28); fixed by OpenAI Oct 26 and rated P1 per the researchers; no OpenAI advisory; no reported in-the-wild use"
published: 2026-10-31
---

> Parameter Labs chained ChatGPT's HTML Preview, a MathLive postMessage listener with no origin check, an unsandboxed srcdoc iframe and a YouTube JSONP callback allowed by CSP, so opening a shared conversation ran code in the victim's signed-in session. Reported Oct 18, fixed Oct 26, rated P1.

[← AI](/ai) · [markdown](/items/parameter-chatgpt-share-link-mathlive-postmessage-account-takeover.md)

researcher write-up (Parameter Labs, Oct 28); fixed by OpenAI Oct 26 and rated P1 per the researchers; no OpenAI advisory; no reported in-the-wild use

2026-10-31

### Parameter: a public ChatGPT share link could run attacker JavaScript as chatgpt.com and read the victim's private chats; OpenAI fixed it Oct 26

Parameter Labs published a write-up on **Oct 28** showing that an ordinary public **ChatGPT share link** could run attacker-controlled JavaScript inside the signed-in session of whoever opened it. In their tests the code listed the victim's conversations, read a private chat that had never been shared, and sent part of it to a researcher server. The researchers say it could "essentially" take any action as the victim on chatgpt.com.

- **Step 1:** ChatGPT's HTML **Preview** runs code in a sandboxed frame on a separate origin. That sandbox held.
- **Step 2:** an interactive graph in the same conversation loaded the **MathLive** library into the main page, which installed a `postMessage` listener for its virtual keyboard that accepted messages from any origin. The Preview sent it a keyboard layout containing HTML, which MathLive wrote into the page with `innerHTML`.
- **Step 3:** that HTML was an `iframe srcdoc` with no sandbox attribute, so it inherited the chatgpt.com origin.
- **Step 4:** ChatGPT's CSP allowed YouTube scripts, and YouTube's oEmbed endpoint echoed an invalid JSONP callback into its error response, which gave script execution.

**Timeline (per Parameter):** reported through OpenAI's bug bounty Oct 18, fixed Oct 26, rated P1. A later version opened Preview automatically, so opening the link was the only step. Parameter reports no real-world use and ran its proof between its own accounts. There's nothing for users to patch.

**For builders:** any third-party widget in a trusted page that listens for `postMessage` without checking the sender is a hole in your sandbox, and every script host in your CSP allowlist that serves JSONP is a script-injection gadget.

Sources: [Parameter Labs: Do the Math: How We Took Over ChatGPT Accounts (Oct 28)](https://www.parameter.ai/labs/we-found-a-gap-at-openai) · [The Hacker News coverage (Oct 31)](https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html)