ProductsHigh importance

Now-fixed ChatGPT flaw let a shared conversation link take over the account of whoever opened it

Parameter showed that a public ChatGPT conversation, prepared by an attacker, could run JavaScript inside the victim's session and read private conversations: simply opening the link was enough, with nothing to install. The chain combined two features that are harmless on their own, the MathLive formula component and the HTML preview. OpenAI reproduced the issue on 10/21, raised the severity to P1 and completed the fix on 10/26. There is no report of real-world use of the flaw.