# DOM XSS in Google VRView library

Google VRView reflected the url/image GET parameter into an error message via innerHTML, yielding DOM XSS on google.com and two WordPress plugins.

- Payout: $3,134
- Severity: high
- Program: Google
- Credited: Federico Fazzi
- Disclosed: 2018-04-23
- Write-up quality: 6/10
- Original: http://blog.mindedsecurity.com/2018/04/dom-based-cross-site-scripting-in.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-mindedsecurity-com-2018-04-dom-based-cross-site-scripting-in-html
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high tech:wordpress technique:recon technique:source-review vuln:xss

**Target:** VRView embed library error handler (url/image GET params)
**Root cause:** showError() assigns the error message (built from the unencoded url/image parameter) to .message.innerHTML, so a nonexistent resource reflects attacker HTML into the DOM.
**Steps:**
1. Request `https://vr.google.com/earth/vrview/?url=%3Cimg%20src=x%20onerror=alert(document.domain)%3E`
2. Library fails to load the resource and calls onSceneError/onRenderError with the raw parameter
3. showError sets `.message.innerHTML = message`, executing the img onerror payload
4. Same works via `?image=` on googlevr.github.io/vrview/index.html and on WordPress plugin endpoints `/wp-content/plugins/wp-vr-view/asset/?image=` and `/wp-content/plugins/vrview/vrview/?image=`
**How found:** Testing the VRView web application; noticed error handling reflected the requested resource name and traced it to an unsafe innerHTML assignment in showError().
**Exploitation:** Attacker crafts a URL with an XSS payload in the url/image parameter; victim visiting the link triggers JS execution in the origin of the embedding site (including google.com), enabling session/data theft or full site takeover on WordPress installs using the plugins.
**Escalation:** Impact raised because the library is embedded on google.com (not only sandboxed domains) and shipped in two popular WordPress plugins, widening the victim pool.
**Insight:** Error/loader message paths that echo the requested resource name are a classic DOM XSS sink; grep third-party embed libraries for `.innerHTML = message` in error handlers and test with a nonexistent url/image param.