Controlling the web message source
Summary: PortSwigger Research describes how web messages become a source for DOM-based vulnerabilities when a page's event listener fails to verify the origin of incoming messages, letting an attacker host a malicious iframe and use postMessage() to pass a payload into a sink such as eval(). It also shows that origin checks built on indexOf, startsWith, or endsWith only test whether a string appears in the origin URL, so an origin like http://www.normal-website.com.evil.net passes verification.
Bottom line: An origin check that looks correct in code review can still accept a message from a domain the attacker controls, and the impact then depends entirely on which sink the listener feeds - in the example given, eval().
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026