# Possible to spoof Origin in "Connected Sites"

MetaMask's Connected Sites list rendered origins with CSS direction:rtl, so a crafted domain like 0-metamask.io displayed as metamask.io-0, spoofing a trusted origin.

- Payout: hidden
- Severity: low
- Program: MetaMask
- Found by: renniepak
- Disclosed: 2023-04-13
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1710564
- Library page: https://bugbountylibrary.com/r/h1%3A1710564
- Tags: area:web3 domain:browser impact:integrity kind:bounty platform:hackerone sev:low tech:chromium technique:unicode-normalization vuln:misconfiguration

**Target:** Browser extension UI (Connected Sites list)
**Root cause:** The site-origin component applies `direction: rtl` to origin text; domains starting with digits followed by a hyphen are reordered by the Unicode BIDI algorithm, displaying a different domain than the actual origin.
**Steps:**
1. Install MetaMask Chrome extension 10.18.4.
2. Navigate to a crafted origin such as `0-a.nl` and accept the connect request.
3. Open extension, click Expand view, then 3 dots > Connected Sites.
4. Observe the origin rendered as `a.nl-0` instead of `0-a.nl`.
5. To simulate a real domain, edit the span in DevTools to `10.18.4-metamask.io` and observe it renders as `metamask.io-10.18.4`.
**How found:** Researcher was experimenting with spoofing origins in MetaMask and noticed the Connected Sites list rendered a numeric-hyphen domain reversed, traced it to `direction: rtl` in site-origin stylesheet combined with BIDI algorithm behavior.
**Exploitation:** Attacker registers a domain like `0-metamask.io` (or a subdomain such as `10.18.4-metamask.io`), gets the victim to connect, and the Connected Sites list displays it as `metamask.io-0`, making it hard for the victim to identify and disconnect the malicious site.
**Insight:** When a UI renders user-controlled identifiers (domains, emails, filenames) with CSS `direction: rtl` or any bidi-sensitive styling, test strings starting with digits/hyphens or containing RTL marks to see if the displayed value diverges from the real one.