Security researchers found a way to turn an ordinary public ChatGPT share into code execution inside a viewer’s signed-in account. The exploit combined a graph that loaded the MathLive library with an HTML Preview running in a restricted frame. MathLive accepted messages from any origin and allowed them to replace its virtual-keyboard layout with HTML. That HTML caused the main ChatGPT page to create an unsandboxed frame, which inherited chatgpt.com’s identity. The researchers then used a YouTube JSONP response permitted by ChatGPT’s content security policy to run JavaScript in that frame. By placing the graph and Preview in the same shared conversation, they made the chain available through a single link; in one version, opening the link alone triggered it.
The injected code could use the victim’s authenticated session to call ChatGPT APIs, list conversations, retrieve messages from a private conversation unrelated to the share, and transmit selected data to an external server. The researchers say the same access could potentially support other actions available through the site’s authenticated APIs. The Preview’s own sandbox had not failed: the weakness was that a component in the main page trusted messages from the Preview, accepted attacker-supplied HTML, and created a frame without sandbox restrictions. The JSONP technique bypassed a further script restriction but was not the underlying flaw. OpenAI fixed the issue on October 26, 2026, and classified it as a P1 vulnerability.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
CVE-2026-98432 is a critical Linux IPv4 TCP handshake use-after-free, remotely exploitable without authentication and potentially allowing root command execution on servers with multipath TCP listeners. Upstream fixes are available, but Ubuntu and RHEL had not yet shipped patched kernels as of October 29, 2026. (atlasum.net)
Colin Percival discovered that Intel Hyper-Threading could leak cryptographic secrets and developed an exploit to recover an RSA key. He argues scholars who find security flaws should coordinate quietly with affected teams so patches are ready before public disclosure. (daemonology.net)
Binance says it has covered 90% of the $6.3 billion in cryptocurrency stolen in a hack and will absorb the losses rather than pass them to users. It has set aside more than $6.34 billion and says sourcing the remaining assets may take longer. (bbc.com)
Plymouth canceled its Flock license-plate camera contract after the system wrongly tracked a couple, but the company did not respond to removal requests. The police chief disconnected the cameras’ power to ensure they stopped recording vehicles. (thedrive.com)
A hacking group said it exploited a vulnerability in software used to manage LED advertising screens, displaying pornographic footage on a highway billboard in Egypt and accessing screens in several other countries. Egyptian authorities opened an investigation and suspended roadside displays, while the incident raised questions about security at the billboard operator. (cairoreport.org)
VOLTA infostealer steals credentials, financial data, and personal details, then sends an evidence bundle to an LLM to rank victims by potential value. If a model refuses, the malware tries a chain of other models, making AI a key part of its intelligence-gathering workflow. (blog.talosintelligence.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.