# Hunting postMessage Vulnerabilities

Insecure postMessage handlers in iCloud and YouTube lacked origin validation, letting any site inject JavaScript into authenticated users' sessions.

- Payout: unconfirmed
- Severity: high
- Program: Apple, Google (Youtube), Adobe
- Credited: Gary O'Leary-Steele, Graham Bacon
- Disclosed: 2020-07-14
- Write-up quality: 8/10
- Original: https://web.archive.org/web/20211016075506/https://insight.claranet.co.uk/technical-blogs/hunting-postmessage-vulnerabilities
- Library page: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20211016075506-https-insight-claranet-co-uk-technical-blogs-hunting-postmessage-vulnerabilities
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:blog sev:high technique:js-analysis technique:source-review vuln:access-control vuln:xss

**Target:** postMessage event handlers in icloud.com and youtube.com JavaScript
**Root cause:** iCloud's SproutCore SC.Event wrapper drops the native event.origin, so URI(undefined) defaults to the current page and validates every message; YouTube's handler JSON.parses message data without checking origin and passes it to window.open.
**Steps:**
1. Load icloud.com with PMHook to log message handlers in javascript-packed.js
2. Observe SC.Event wrapping strips .origin; URI(undefined) defaults to current page
3. Send `{"isCloudOSMessage":true,"methodName":"sendLocalNotification","appName":"contacts","args":[{"soundPath":"\u0022><img src=a onerror=alert(123)>","badgeCount":100}]}` via postMessage
4. For YouTube, send `{"video-masthead-cta-tracking":true}` then `{"video-masthead-cta-clickthrough":"javascript:alert(document.domain)"}` to the video_masthead page
**How found:** Passive scan with AppCheck NG surfaced postMessage handlers; PMHook wrapped addEventListener to log handlers and messages, then code audit of prettified minified JS traced origin validation and sink paths.
**Exploitation:** Attacker page opens/frames the target, waits for load, then postMessages a crafted JSON payload; iCloud routes it through sendLocalNotification→playSound which appends an <audio> tag with unescaped soundPath, executing injected markup in the victim's authenticated iCloud origin.
**Escalation:** iCloud XSS enables reading email/contacts and session hijack of authenticated users; YouTube XSS via javascript: URL in window.open.
**Insight:** Framework event wrappers (e.g. SproutCore SC.Event) copy only whitelisted properties, silently dropping origin — check whether validation reads event.origin or a wrapped object; also trace postMessage data to window.open/javascript: sinks.