Chained flaw in ChatGPT public share links exposed private conversations

A chain of flaws allowed a public ChatGPT◆ share link to deliver attacker-controlled JavaScript into the victim's signed-in session, exposing private conversations. The article does not give a CVE ID or affected version range. OpenAI◼ fixed the issue on October 26 and rated it P1, and the Parameter researchers' technical write-up says it earned a $5,000 bounty. The article gives no defender action beyond the vendor fix, so confirm that OpenAI's fix is in place and review the write-up for the exact attack chain.

For security analysts · Written by AI from 1 source · Wrong?