Lab: DOM XSS using web messages and JSON.parse
Summary: This PortSwigger lab demonstrates DOM XSS through web messaging: a postMessage() call sends a message with type load-channel to the home page, whose event listener parses it with JSON.parse() and passes it to a switch. The load-channel case assigns the message's url property to the src attribute of the ACMEplayer.element iframe, and because the second postMessage argument allows any targetOrigin and the handler performs no origin check, a JavaScript payload in that url property is set as the iframe src and print() executes when the victim loads the page.
Why it matters: The vulnerability is a missing origin check on a message handler that feeds JSON-parsed input straight into an iframe src, so any page that can post a message to the target can run script in the victim's browser.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026