ChatGPT Share Links Enabled Account Takeover — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- ChatGPT’s public share feature packaged a graph that loaded MathLive and an HTML Preview into one /share/<id> exploit in October 2026; victims needed no app, workspace, pasted code or developer tools—only a link visit and, in the first stable version, one Preview click.
- MathLive installed a main-page listener that accepted keyboard-layout messages from any origin, then used an unsanitized helper to place Preview-supplied HTML into innerHTML.
- YouTube oEmbed JSONP supplied the next escape: ChatGPT’s CSP allowed YouTube scripts, so callback code ran inside an unsandboxed srcdoc iframe that inherited chatgpt.com’s identity.
- ChatGPT’s authenticated APIs let the injected code enumerate recent conversations, fetch messages from a private conversation never shared with the attacker and send selected content to an attacker-controlled server.
- ChatGPT’s authenticated frontend APIs exposed other account data and actions inside the same security boundary, leading the researchers to describe the exploit as effectively allowing any action on the victim’s account.
- OpenAI fixed the vulnerability on October 26 and classified the report as P1.
Why it matters: For ChatGPT users, one shared link exposed private conversations and enabled actions under their authenticated account; for OpenAI, the October 26 P1 fix closes the demonstrated route, while the multi-feature chain shows how separately reasonable integrations can combine into cross-account compromise.
Ask SkimNews
