# H1514 DOM XSS on checkout.shopify.com via postMessage handler on /:id/sandbox/google_maps

Malicious shop injected HTML into a Google Maps marker title via postMessage to checkout.shopify.com sandbox route, executing DOM XSS on the checkout origin.

- Payout: $500
- Severity: medium
- Program: Shopify
- Credited: bored-engineer
- Disclosed: 2019-11-04
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/423218
- Library page: https://bugbountylibrary.com/r/h1%3A423218
- Tags: domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:rest technique:chained technique:recon vuln:xss

**Target:** checkout.shopify.com /:id/sandbox/google_maps postMessage handler
**Root cause:** The sandbox page validated the postMessage origin against the shop ID but then trusted all subsequent messages, passing attacker-controlled marker title into HTML without sanitization.
**Steps:**
1. Create a shop and capture its numeric ID (e.g. 4736483384).
2. Add script to shop template that creates an iframe pointing to `https://checkout.shopify.com/<id>/sandbox/google_maps`.
3. On iframe load, send `frame.contentWindow.postMessage("shopify_google_api:"+JSON.stringify({action:"createMapAndMarkers",body:[{title:"<img src=xx: onerror=alert(document.domain)>"}]}), "*")`.
4. Visit the shop page; the marker title HTML executes on checkout.shopify.com.
**How found:** Noticed the sandbox routes accept postMessage from the shop origin, validated origin only once, then trusted the message body; hypothesized marker title was rendered as HTML.
**Exploitation:** Attacker controls a shop, embeds the checkout sandbox iframe on their storefront, and posts a crafted createMapAndMarkers message whose marker title contains an img onerror payload; the sandbox renders it as HTML, executing JS in the checkout.shopify.com origin.
**Insight:** When a page validates postMessage origin once but then trusts the message payload, look for fields (labels, titles, tooltips) that get rendered as HTML inside the privileged origin—sandbox/iframe helper routes are prime targets.