# URL Advisor component in KIS products family is vulnerable to Universal XSS

Kaspersky URL Advisor balloon frame served first-party on every domain accepts postMessage without origin check, letting any site inject a javascript: link and achieve universal XSS.

- Payout: hidden
- Severity: high
- Program: Kaspersky
- Found by: palant
- Disclosed: 2019-08-28
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/463915
- Library page: https://bugbountylibrary.com/r/h1%3A463915
- Tags: area:os domain:browser impact:data-leak impact:integrity kind:bounty platform:hackerone sev:high tech:windows technique:source-review vuln:clickjacking vuln:xss

**Target:** URL Advisor balloon UI frame (url_advisor_balloon.html) in Microsoft Edge
**Root cause:** The URL Advisor frame is served as first-party content under every visited domain and consumes window.postMessage() data without validating the sender origin; the data is later assigned as a link target, permitting a javascript: URL.
**Steps:**
1. Host a page on a domain starting with `www.google.` (e.g. add `127.0.0.1 www.google.example.com` to hosts) so URL Advisor applies.
2. Serve `universal_xss.html` that postMessages crafted data to the url_advisor_balloon.html frame.
3. The frame assigns the attacker data as a link target pointing to a `javascript:` URL.
4. Frame the balloon (no X-Frame-Options on it) and use clickjacking to make the user click the link.
5. Payload `alert('Hi, this JavaScript code is running on ' + document.domain)` executes in the context of the spoofed google.com origin.
**How found:** Noticed in Edge DevTools that the URL Advisor frame is loaded under the visited site's own origin (e.g. https://www.google.com/<INJECT_ID>/ua/url_advisor_balloon.html) rather than Kaspersky's domain, then inspected its postMessage handling and found no origin validation and a link-target sink.
**Exploitation:** Attacker page frames the first-party URL Advisor balloon, sends postMessage data setting the link target to a javascript: URL, and clickjacks the victim into clicking it, executing script in the context of the spoofed domain and allowing background data exfiltration.
**Escalation:** Because the UI is first-party on every domain, a single XSS becomes universal XSS affecting any site the user visits.
**Insight:** When a security vendor's browser extension/UI is injected as first-party content under the visited origin, audit its postMessage listeners for missing origin checks and DOM sinks (link href, innerHTML) — any XSS there is universal. Compare behavior across browsers: same component may be isolated in one and first-party in another.