// ChatgptCRITICAL
In October 2026, Parameter security researchers disclosed a critical P1 vulnerability in ChatGPT enabling account takeover via malicious link. The exploit chained three features (Preview, Graph Visualization, Public Sharing) through postMessage API misuse and Content Security Policy bypass to execute arbitrary code as chatgpt.com. Attackers could access private conversations, exfiltrate data, and perform authenticated actions without user interaction. OpenAI patched the vulnerability by October 26, 2026.
- ChatGPT Account Takeover: How a Simple Link Could Compromise You(opens in a new tab)
- ChatGPT Shared-Link Flaw Exposed Private Chats Before OpenAI Fix(opens in a new tab)
- ChatGPT Shared-Link Session Takeover: October 2026 Fix, Attack P(opens in a new tab)
- ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Ph(opens in a new tab)
- OpenAI Fixes High-Severity ChatGPT Flaw That Exposed Private Con(opens in a new tab)
// Get alerts for Chatgpt