One click into someone else's ChatGPT: a cross-frame messaging vulnerability

Researcher Parameter disclosed on October 28, 2026 that a publicly shared ChatGPT conversation link could execute attacker-supplied JavaScript in the session of whoever opened it while logged in, enumerate their recent conversations, read private chats that were never shared, and exfiltrate data to an external server. After reproducing it, OpenAI raised the severity from P2 to P1 and completed the fix on the frontend of two versions on October 26 (eight days after the report), with no user action required; Parameter said no real-world exploitation was found. Initially a single click on Preview was required, after which it was changed to open automatically, so that merely opening the link triggers it, and the payload executes after about 4.5 seconds. The researcher said the same script context could perform any action on the account on behalf of the victim, but this is an inference based on the permissions obtained, and the PoC deliberately limited the exfiltrated content.