A crafted ChatGPT share link could read a signed-in visitor's private data

single source· 1 articles · confidence: high · first seen 2026-10-31 23:15 UTC

What this means for you

If you render model- or user-generated HTML, the sandbox is not where this kind of bug lives: the chain started with a `postMessage` listener in the parent page that trusted any frame, and an `innerHTML` write. Audit those two first.

Parameter Labs found a chain of bugs that let a crafted ChatGPT share link run its own JavaScript inside the session of any signed-in user who opened it, according to Simon Willison's 31 October writeup. The route ran through ChatGPT's HTML previews, where generated web apps run in a sandboxed iframe (an embedded page fenced off from the host page). A virtual keyboard library in the parent page accepted messages from any frame, its handler wrote raw HTML, and a permitted YouTube endpoint reflected script that executed. OpenAI closed the hole and paid a $5,000 bounty, which Willison calls cheap.

Key facts

  • ·Parameter Labs found the exploit chain in ChatGPT's HTML previews feature, the current form of what OpenAI called Canvas, per a 31 October 2026 writeup. source
  • ·The chain began with the MathLive virtual keyboard library in the parent page, whose message handler used innerHTML and accepted postMessage calls from sandboxed iframes. source
  • ·OpenAI's content security policy blocked inline scripts but allowed a handful of domains including YouTube; the YouTube oEmbed endpoint reflected JavaScript that executed. source
  • ·After gaining JavaScript execution, the researchers fetched private user data from APIs and exfiltrated it through an image reference. source
  • ·OpenAI paid a $5,000 bug bounty for the report. source

What the sources say

  • Simon Willison (press) — Walks through Parameter Labs' exploit chain step by step and argues the $5,000 payout undersells its severity.

Sources

The original reporting. Follow these — they did the work.

← the wire