A shared ChatGPT conversation escaped Preview isolation and read private chats

The researchers embedded a payload in a public share and combined an HTML Preview interaction with MathLive messaging behavior. Their controlled chain crossed the intended origin boundary and gained access to authenticated conversation APIs that should not have been available to a shared document. The report states OpenAI fixed the vulnerability on October 26. A successful controlled test does not establish widespread exploitation or the number of affected accounts.

The critical capability change occurred after attacker-authored shared content was interpreted inside browser preview and message handling: the resulting code gained an authenticated origin rather than remaining a passive public-share document. The claimed fix should be regression-tested at both message-origin validation and the private-conversation API boundary. The published reproduction does not supply a production victim count.

Mechanism detail from the October 28 researcher account. The public share could contain both a normal graph that registered MathLive's virtual-keyboard message receiver in the main ChatGPT document and an attacker-controlled HTML Preview running on an isolated origin. Preview code sent postMessage events to update the keyboard layout and show it. The receiver accepted the message without sufficiently constraining its sender; layout markup then reached innerHTML in the signed-in origin. A subsequent iframe srcdoc behavior enabled script execution and access to authenticated conversation APIs. The researchers confirmed extraction of an unrelated private conversation in their controlled test. Parameter dates the fix to October 26 and reports P1 classification. The record documents a browser-origin and embedded-component authorization failure, not model compliance with a malicious instruction.

The final stage also matters. An ordinary script element inserted through innerHTML does not run automatically. According to Parameter, an unsandboxed srcdoc iframe inherited the parent origin, and a CSP-permitted YouTube oEmbed JSONP response provided the executable script despite inline-script restrictions. Blocking the particular JSONP endpoint would break that final route but would not repair the original authorization failure in MathLive message acceptance or the HTML sink. The researcher reports OpenAI reproduced the private-chat disclosure proof and confirmed the cross-frame message fix on October 26. The public account does not establish independent post-fix regression testing.