# Universal Code Execution by Chaining Messages in Browser Extensions

Wildcard content scripts forwarding unvalidated postMessage to native messaging hosts let any webpage load an attacker DLL via PKCS11Lib path, achieving code execution.

- Payout: Research
- Severity: critical
- Program: Smart Card extensions
- Write-up by: Eugene Lim
- Disclosed: 2024-07-07
- Write-up quality: 8/10
- Original: https://spaceraccoon.dev/universal-code-execution-browser-extensions/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-universal-code-execution-browser-extensions
- Tags: area:os domain:desktop domain:web impact:data-leak impact:rce kind:research platform:research sev:critical technique:chained technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:path-traversal vuln:rce

**Target:** Browser extension content script → background → native messaging host (.NET)
**Root cause:** Content scripts injected on all origins forward postMessage data (with a spoofable src check) to the background script, which passes it unvalidated to a native host that loads a DLL from an attacker-controlled PKCS11Lib path.
**Steps:**
1. Identify extension with wildcard content_scripts and nativeMessaging permission (query chrome-extension-manifests-dataset, Semgrep taint rule for postMessage→sendMessage).
2. Confirm content script forwards `event.data` to `chrome.runtime.sendMessage` with only a spoofable `event.data.src === 'user_page.js'` check.
3. Confirm background script relays message to `chrome.runtime.connectNative('example.b.chrome.host')` via `port.postMessage(request)`.
4. Reverse the native .NET host; find `GetCertLib` action passes `PKCS11Lib` to `LoadPkcs11Library` after prefixing `C:\Windows\System32\`.
5. Trigger download of malicious DLL to known path (e.g. Downloads).
6. Send `window.postMessage({src:'user_page.js', action:'GetCertLib', PKCS11Lib:'..\\..\\..\\..\\..\\Users\\James\\Downloads\\payload.txt'}, '*')` to traverse out of System32 and load the DLL.
**How found:** Revisited Arseny Reutov's 2017 postMessage-to-native relay research; queried the chrome-extension-manifests-dataset for extensions with >250k users, content scripts, and nativeMessaging, then ran a Semgrep taint rule flagging postMessage handlers lacking origin checks that forward to sendMessage/port.postMessage; manually reviewed candidates and reverse-engineered the native host binary.
**Exploitation:** Victim visits attacker page with the vulnerable extension installed; page triggers a file download of a malicious DLL, then postMessages a GetCertLib action with a traversal PKCS11Lib path pointing at the download; the native host loads the DLL, executing attacker code on the host OS.
**Escalation:** Chain extends from web page → content script → background → native app, breaking Same Origin Policy and the browser sandbox to reach full OS command execution; also demonstrated cookie theft (GETCOOKIE) as a lesser SOP breakout.
**Insight:** The `event.source !== window` check is useless when the content script is injected on all origins—any page can postMessage itself. Hunt extensions with wildcard matches + nativeMessaging, then reverse the native host for path/DLL/command sinks like PKCS11Lib that accept attacker-controlled paths.