# Cross-origin message handler trusts sender

postMessage or WebSocket handlers acting on privileged operations without validating event.origin or source

_Area: Web access control and IDOR. Seen in 5 disclosed reports; 2 confirmed bounties: $800 and $1,050; latest 2026-09-24. Updated 2026-10-23._

## How it works
A privileged page, extension page, or collaboration channel accepts messages from any sender and acts on them. The broken assumption is that only trusted code can reach the handler. In practice any web page, iframe, or collaborator can post a message or mutate shared state, and the handler performs the privileged action (uninstall, camera start, tab open, authenticated request) on the attacker's behalf. The trust boundary is the message channel, but the code never checks who is on the other end.

## Where it shows up
- `window.addEventListener('message', ...)` or WebSocket handlers that read `event.data` and act without checking `event.origin` or `event.source`.
- `web_accessible_resources` with broad `matches` (e.g. `<all_urls>`) pointing at pages that auto-invoke privileged APIs on load [E2](https://bugbountylibrary.com/r/bc%3Aa5983cee-8017-4a18-b7b9-bebeaa72e2e5.md).
- Extension pages that drive privileged flows (uninstall, block, scan) and consume postMessage data [E3](https://bugbountylibrary.com/r/h1%3A470519.md).
- Content scripts that forward `window.postMessage` commands to background APIs like `chrome.tabs.create` [E4](https://bugbountylibrary.com/r/h1%3A389076.md).
- Client-side buttons that read a DOM value to build a request URL, where a cross-user channel can write that DOM node [E1](https://bugbountylibrary.com/r/h1%3A837328.md).

## How to review
For every message listener, confirm the handler validates `event.origin` against an allowlist and, where relevant, `event.source`/`event.origin` of the expected frame before acting. For extension pages, check whether the page is web-accessible and whether it performs privileged actions on load or on message without an extension handshake [E2](https://bugbountylibrary.com/r/bc%3Aa5983cee-8017-4a18-b7b9-bebeaa72e2e5.md)[E3](https://bugbountylibrary.com/r/h1%3A470519.md). For content scripts, trace postMessage commands to background privileged calls and confirm origin and user-gesture checks [E4](https://bugbountylibrary.com/r/h1%3A389076.md). For collaboration channels, confirm that data written into the DOM cannot flow into a request URL without validation [E1](https://bugbountylibrary.com/r/h1%3A837328.md). The invariant: a privileged action must only execute when the sender is authenticated and authorized for that action.

## Variants seen
- Web-accessible extension page auto-activates camera on load, no origin check [E2](https://bugbountylibrary.com/r/bc%3Aa5983cee-8017-4a18-b7b9-bebeaa72e2e5.md).
- Web-accessible warning page accepts unauthenticated postMessage to uninstall extensions [E3](https://bugbountylibrary.com/r/h1%3A470519.md).
- Content script forwards postMessage `open-url` to `chrome.tabs.create` without origin or gesture check [E4](https://bugbountylibrary.com/r/h1%3A389076.md).
- WebSocket form-update writes attacker values into DOM, which a button interpolates into an authenticated request URL [E1](https://bugbountylibrary.com/r/h1%3A837328.md).

## Impact and severity
Led to silent webcam activation [E2](https://bugbountylibrary.com/r/bc%3Aa5983cee-8017-4a18-b7b9-bebeaa72e2e5.md), arbitrary extension uninstall [E3](https://bugbountylibrary.com/r/h1%3A470519.md), unlimited tab opening to arbitrary URLs [E4](https://bugbountylibrary.com/r/h1%3A389076.md), and authenticated POST requests as another user [E1](https://bugbountylibrary.com/r/h1%3A837328.md). Severity rises when the action is silent, requires no user gesture, and reaches sensitive APIs or other users' sessions. Broad `matches` and auto-initialization widen exposure.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A837328.md
- E2: https://bugbountylibrary.com/r/bc%3Aa5983cee-8017-4a18-b7b9-bebeaa72e2e5.md
- E3: https://bugbountylibrary.com/r/h1%3A470519.md
- E4: https://bugbountylibrary.com/r/h1%3A389076.md