# Handling of `tracking` command allows making arbitrary blind requests with user's cookies from Grammarly Extension's origin

Grammarly extension's tracking command handler let any page invoke gnar._fetch, making credentialed cross-origin requests from the extension origin to any site.

- Payout: hidden
- Severity: critical
- Program: Superhuman (formerly Grammarly)
- Found by: metnew
- Disclosed: 2019-08-01
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/389108
- Library page: https://bugbountylibrary.com/r/h1%3A389108
- Tags: area:os domain:browser impact:internal-access kind:bounty platform:hackerone sev:critical technique:chained technique:source-review vuln:access-control vuln:csrf

**Target:** Browser extension content script and background page message handler
**Root cause:** Content script forwards page-controlled postMessage 'tracking' commands to the background page, which applies the attacker-chosen method name on the gnar tracker object, exposing _fetch and other methods with extension privileges.
**Steps:**
1. Open a crafted page that calls `window.postMessage({grammarly:true, action:'tracking', method:'gnar._fetch', props:{method:'GET', headers:{'Content-Type':'application/json'}}, param:'https://mail.google.com/mail/u/0/#inbox'}, '*')`
2. Content script's Z() handler matches action 'tracking' and emits 'tracking-call' to background
3. Background handler splits method on '.', resolves gnar._fetch and calls it with attacker params
4. Extension performs XHR with cookies to the target origin
5. Observe request in extension debug page Network tab containing Gmail content
**How found:** Noticed events have isTrusted and popup editor can be initiated by page; reasoned content script can only reach background after popup init, then traced postMessage 'tracking' handling through content script into background runMessage and the dynamic gnar[method].apply call.
**Exploitation:** Attacker page posts a tracking command selecting gnar._fetch with arbitrary URL, method, headers and body; the extension issues the request with its all-URLs permission and cookies, enabling blind CSRF against any origin lacking token-based protection (e.g. changing Grammarly username via auth.grammarly.com/v3/user).
**Escalation:** Can call any method on p.tracker.gnar (e.g. setUser) and overwrite tracker properties; potential UXSS considered but not demonstrated.
**Insight:** Extension message bridges that dynamically resolve method names from page-controlled strings (obj[method].apply) expose internal privileged helpers like fetch polyfills; test postMessage action handlers for arbitrary method dispatch and check whether the fetch polyfill permits chrome-extension:/data: origins.