# DOM XSS in Gmail with a little help from Chrome

Gmail's hangouts frame accepted postMessage data containing a URL and loaded it as an iframe src without origin check, enabling DOM XSS via javascript: URI.

- Payout: unconfirmed
- Severity: high
- Program: Google
- Credited: Enguerran Gillier
- Disclosed: 2020-05-03
- Write-up quality: 7/10
- Original: https://opnsec.com/2020/05/dom-xss-in-gmail-with-a-little-help-from-chrome
- Library page: https://bugbountylibrary.com/r/blog%3Aopnsec-com-2020-05-dom-xss-in-gmail-with-a-little-help-from-chrome
- Tags: domain:web impact:ato kind:bounty platform:blog sev:high technique:js-analysis technique:source-review vuln:xss

**Target:** Gmail web app cross-frame postMessage handler
**Root cause:** The message listener in mail.google.com took a URL from postMessage data and set it as an iframe src via appendChild without validating the message origin, allowing javascript: URIs.
**Steps:**
1. Log cross-frame postMessage traffic with a custom extension; spot a message from hangouts.google.com to mail.google.com containing a URL with 'frame'.
2. Filter DevTools network by type 'doc' to see the same URL loaded as an iframe with referrer mail.google.com.
3. Click the initiator to reach the appendChild() call, unminify, set breakpoint, reload to confirm the iframe src comes from message data.
4. From console send the same message data but with `javascript:alert(1)` as the URL.
5. CSP blocks it in Chrome; on IE11/Edge (no CSP enforcement) the alert fires, confirming no origin check.
**How found:** Logged postMessage traffic between Gmail iframes, noticed a message containing a URL with 'frame', correlated it with a 'doc' network request, then used DevTools initiator/breakpoint to trace appendChild() setting iframe src from message data.
**Exploitation:** Attacker page opens a new tab to Gmail and postMessages a payload with `javascript:alert(1)` as the iframe URL; Gmail loads the javascript: iframe giving arbitrary JS execution in the victim's Gmail origin, enabling reading/sending emails and account takeover actions.
**Escalation:** Bypass of the random 6-char channel name via loading an attacker-controlled iframe into Gmail's frame hierarchy to intercept the channel name (theoretical, not achieved).
**Insight:** Cross-frame postMessage traffic is a rich DOM XSS source; log it, correlate message data with iframe/network loads, and trace the initiator to find sinks that trust message data without origin checks.