# Cross-origin embed leaks authenticated data

Cookie-authenticated media, player or JSONP endpoints readable from other origins, leaking private data or identity

_Area: Web access control and IDOR. Seen in 3 disclosed reports; 2 confirmed bounties: $1,120 and $1,337; latest 2021-01-18. Updated 2026-11-07._

## How it works

A resource is protected only by the victim's cookies, but the browser lets any site embed it (image, media, script, iframe, postMessage). The victim's browser attaches the cookies, the server answers as if the request were legitimate, and the attacker's page reads the result or infers it from success/failure. The broken assumption: "only the owner can reach this URL" — true for direct requests, false for cross-origin inclusion, because same-origin policy does not cover images, media, or script tags, and embedded widgets inherit the viewer's session.

## Where it shows up

- Private media URLs (DM images, attachments, avatars) served on a cookie-only check with no per-request token [E2](https://bugbountylibrary.com/r/h1%3A329957.md)
- Embedded players/widgets that call authenticated APIs and expose data via `postMessage` or JS getters [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md)
- JSON/JSONP endpoints (`jsonp_dump`, callback params) on data gated by a privacy setting [E3](https://bugbountylibrary.com/r/h1%3A361951.md)
- Privacy checks that branch on auth state (403 only for anonymous) rather than on ownership [E3](https://bugbountylibrary.com/r/h1%3A361951.md)
- Special/private collections (history, likes, uploads) loadable by ID in a shared widget [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md)

## How to review

For every per-user resource, ask: can another origin embed or script it, and does the response depend only on cookies? The invariant: access to private data must require a credential the attacker's page cannot supply — a per-request token, an origin check, or `SameSite`/`Cross-Origin-Resource-Policy` — not just the victim's ambient cookie. Check that privacy gates run for authenticated cross-site requests too, and that widgets returning data via `postMessage` validate the embedding origin and never expose owner-only collections.

## How finders spotted it

- Knew YouTube's special playlists (HL, WL, Liked, Uploads) and the player's `postMessage` API separately, then combined them: the embedded player is authenticated as the viewer, so `getPlaylist()` would return owner-only contents [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md)
- Reasoned that cookie-gated resources exempt from SOP act as an oracle: whether a per-user private image loads reveals whether the visitor is that user [E2](https://bugbountylibrary.com/r/h1%3A329957.md)
- Noticed `charts.json.spt` used `jsonp_dump` while the `hide_receiving` check only guarded direct requests, so a cross-site script tag carries cookies past the 403 [E3](https://bugbountylibrary.com/r/h1%3A361951.md)

## Variants seen

- Authenticated widget as confused deputy, leaking history/likes/unlisted IDs via JS getters and postMessages [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md)
- Load-success/failure oracle on private images, leaking identity rather than content [E2](https://bugbountylibrary.com/r/h1%3A329957.md)
- JSONP callback bypassing an auth-dependent privacy setting [E3](https://bugbountylibrary.com/r/h1%3A361951.md)

## Impact and severity

E1 leaked watch history, likes and unlisted video IDs, and chained playlist-ID enumeration to target arbitrary victims [E1](https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md). E2 turned private DM images into an identity-confirmation oracle [E2](https://bugbountylibrary.com/r/h1%3A329957.md). E3 disclosed donation-receiving data despite a privacy setting [E3](https://bugbountylibrary.com/r/h1%3A361951.md). Severity rises with how much private data the endpoint returns and whether IDs can be derived for any victim.

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **YouTube IFrame Player API** (embedded player postMessage / getPlaylist) (version not stated): The Embedded YouTube Player Told Me What You Were Watching (and more). Report: https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2021-01-18-the-embedded-youtube-player-told-me-what-you-were-watching-and-more.md
- E2: https://bugbountylibrary.com/r/h1%3A329957.md
- E3: https://bugbountylibrary.com/r/h1%3A361951.md