# Universal XSS through FIDO U2F register from subframe

Cross-origin subframe calls U2F.postMessage to trigger u2f.register; unescaped version param in evaluateJavaScript yields UXSS on top frame.

- Payout: hidden
- Severity: high
- Program: Brave Software
- Found by: nishimunea
- Disclosed: 2023-06-22
- Write-up quality: 8/10
- Original: https://hackerone.com/reports/993670
- Library page: https://bugbountylibrary.com/r/h1%3A993670
- Tags: area:mobile domain:browser domain:mobile impact:integrity kind:bounty platform:hackerone sev:high tech:ios technique:chained technique:source-review vuln:auth-bypass vuln:xss

**Target:** FIDO U2F WebAuthN implementation in Brave iOS
**Root cause:** U2F.postMessage handler accepts u2f.register from cross-origin subframes and passes the attacker-controlled version parameter into evaluateJavaScript without escaping.
**Steps:**
1. Host victim page on alice.csrf.jp with cross-origin iframe to evil.csrf.jp
2. From the subframe invoke `U2F.postMessage` directly to call `u2f.register()`
3. Observe Ready to Scan dialog shows top-frame origin, not caller subframe
4. Insert FIDO device (YubiKey 5Ci) and touch
5. Injected JavaScript from the version parameter executes via evaluateJavaScript on the top frame
**How found:** Code review of U2F.js postMessage handler and U2FExtensions.swift evaluateJavaScript call revealed missing origin check and missing escaping of the version parameter.
**Exploitation:** Malicious subframe triggers a fake U2F registration; the version string is injected into evaluateJavaScript executed in the top frame, achieving UXSS on the victim origin after user touches the key.
**Insight:** When a native bridge exposes postMessage handlers to web content, check whether subframe callers are origin-validated and whether any parameter reaches evaluateJavaScript/string interpolation unescaped.