Opening a ChatGPT shared link sometimes yields unexpected results. On October 26, a vulnerability was disclosed where shared links led to account takeover, patched the same day with a $5,000 bug bounty. The cause was the combination of two design choices: how the MathLive math keyboard library handles postMessage, and the possibility of bypassing ChatGPT's iframe CSP (content security policy). Based on GitHub digest issues and publicly available bug bounty information, we trace the technical path. This article does not reverse-engineer ChatGPT's actual source; it covers only publicly available information and reproducible principles.
Where two technical elements meet
The vulnerability arose not from a single mistake, but from two design choices overlapping.
First, MathLive's postMessage chain. ChatGPT's UI includes the MathLive library for entering mathematical formulas. This library exchanges messages with the parent window via postMessage inside an iframe. When a shared link opened, MathLive did not close its postMessage reception path even when loaded from an external source.
Second, iframe CSP bypass. ChatGPT renders inside an iframe, but the CSP did not fully restrict postMessage reception. If the message format sent by MathLive could be spoofed, messages could be delivered to channels ChatGPT trusted.
Image: Conceptual diagram of MathLive postMessage chain and iframe CSP bypass.
The attack path, step by step
Reconstructed from publicly available information, the attack path is as follows.
Step 1: Shared link creation. An attacker creates a conversation in ChatGPT and obtains a shared link. This link takes the form chatgpt.com/?share=....
Step 2: External MathLive loading. When the shared link opens, the MathLive library loads from an external source controlled by the attacker. Normally loaded from ChatGPT's domain, the CSP did not fully restrict MathLive's source.
Step 3: postMessage chain manipulation. When MathLive sends postMessage from inside the iframe, the attacker-controlled version of MathLive sends spoofed messages. ChatGPT recognizes these messages as coming from a trusted channel.
Step 4: Account context takeover. The spoofed message manipulates ChatGPT's authentication context, allowing the attacker to execute some actions on behalf of the account.
Why $5,000
Bug bounty amounts are determined by impact and exploit difficulty. This vulnerability was evaluated at $5,000, reflecting the following factors:
| Factor | Description |
|---|---|
| Impact | Shared link alone enables account takeover. Occurs automatically when a user opens the link. |
| Exploit difficulty | Requires understanding MathLive's postMessage handling. Difficult for general users, but possible for security researchers. |
| Fix scope | Resolved by limiting MathLive's postMessage reception path to shared link context. |
| User count | ChatGPT has tens of millions of users. The scale of affected users is large. |
Patch details and remaining questions
The October 26 patch limited the reception path of the publicly disclosed MathLive postMessage chain to shared link context. Specific code changes vary depending on the bug bounty program's private policy, but generally one or more of the following apply:
- Separately applying
allow-scriptsandallow-same-originto the MathLive iframe'ssandboxattribute - Additional origin validation when receiving postMessage
- Fixing the MathLive loading source in shared link context
Remaining questions after the patch:
| Question | What to check |
|---|---|
| Was the postMessage path limited in all MathLive versions? | Version-by-version test results |
| Is the same path open in regular chats, not just shared links? | Regular chat context testing |
| Do other iframe-based libraries have the same bypass possibility? | Review of similar libraries |
Constraints before adoption
What this article measures is publicly available information and reproducible principles. Since we did not reverse-engineer ChatGPT's actual source, the exact post-patch behavior must be confirmed through OpenAI's official announcement. Also, the $5,000 bug bounty may not cover all affected scenarios, and undisclosed additional paths may exist.
The point to note when using ChatGPT shared links is that your current account must be logged in to the browser session where the link opens. The vulnerability does not affect incognito mode or logged-out states.
The paid course below covers security verification of AI services and bug bounty participation methods. It is not a course providing ChatGPT vulnerability usage or reproduction of this experiment; the link is a promotional link.