#postMessage

ChatGPT share-link flaw let attackers run code in victims' sessions and read private chats; OpenAI has fixed it

Researchers chained four ChatGPT web features so a shared chat link could read a viewer's private conversations. OpenAI fixed it on October 26, 2026; no user action is needed.