Security vulnerabilities and automated fixes for postmessage issues
3 posts found
A critical cross-origin message injection vulnerability was discovered in `offscreen.js`, where a wildcard `"*"` origin in `postMessage` calls and a missing source validation check allowed any webpage to send arbitrary messages to the extension's iframe. The fix adds an explicit source check and replaces the wildcard with `"null"` to restrict communication to the trusted iframe only. This change prevents malicious websites from hijacking the extension's offscreen message channel.
A medium-severity vulnerability was discovered in `frontend/resources/js/bridge.js` where `window.postMessage()` was configured with a wildcard (`"*"`) as the target origin, potentially allowing any malicious website to intercept sensitive messages. This misconfiguration opens the door to information disclosure attacks by removing all origin-based restrictions on who can receive cross-frame communications. The fix restricts message delivery to only trusted, explicitly defined origins — closing a
A critical security flaw in a browser extension's authentication flow was sending sensitive session tokens and user data to any website using the wildcard "*" origin in postMessage. This vulnerability could have allowed malicious sites to intercept authentication credentials, but was fixed by restricting message delivery to the application's own origin.