# Injected script shares page context

Security or autofill script injected into untrusted pages without isolation, reachable by page JS

_Area: Web injection and code execution. Seen in 3 disclosed reports; latest 2019-11-24. Updated 2026-10-23._

## How it works
A privileged component (security product, password manager) injects its script or UI into an untrusted web page instead of running it in an isolated context. The page's own JavaScript therefore shares the same execution environment as the injected code. Any assumption that the injected code is hidden from, or protected against, page scripts breaks: the page can observe, hook, or re-trigger it. The root cause is missing isolation between trusted injected code and untrusted page code [E1](https://bugbountylibrary.com/r/h1%3A470544.md)[E2](https://bugbountylibrary.com/r/h1%3A470547.md)[E3](https://bugbountylibrary.com/r/h1%3A430854.md).

## Where it shows up
- Product falls back to injecting a script into pages when no extension is present [E1](https://bugbountylibrary.com/r/h1%3A470544.md).
- Injected script runs in the page JS context rather than an isolated world [E2](https://bugbountylibrary.com/r/h1%3A470547.md).
- Only a few globals are hardened (e.g. WebSocket) while built-ins like String.indexOf stay hookable [E2](https://bugbountylibrary.com/r/h1%3A470547.md).
- Autofill or UI rendered directly into the page DOM with no shadow DOM or iframe boundary [E3](https://bugbountylibrary.com/r/h1%3A430854.md).
- Injected code exposes a command interface or namespace reachable from page scope [E1](https://bugbountylibrary.com/r/h1%3A470544.md)[E2](https://bugbountylibrary.com/r/h1%3A470547.md).

## How to review
The invariant: no page-controlled code can reach the injected component's namespace, command interface, or UI, and cannot trigger privileged actions. Check that injected scripts run in an isolated world or extension context, not the page context. Verify that every global the injected script calls is either protected or not observable by the page. For UI, confirm shadow DOM or iframe isolation and that fill actions require explicit user consent. Test whether the page can re-download itself to locate the injected script, or swap stored object references before re-execution [E1](https://bugbountylibrary.com/r/h1%3A470544.md).

## Variants seen
- Self-download plus object-reference manipulation to defeat address-hiding and pre-injection protections [E1](https://bugbountylibrary.com/r/h1%3A470544.md).
- Hooking an unhardened built-in (String.indexOf) to leak the injected namespace and command interface [E2](https://bugbountylibrary.com/r/h1%3A470547.md).
- Instrumenting an unisolated autofill UI to trigger filling and read stored address data [E3](https://bugbountylibrary.com/r/h1%3A430854.md).

## Impact and severity
High: sites could disable security protections and potentially reach SYSTEM-level command execution [E1](https://bugbountylibrary.com/r/h1%3A470544.md)[E2](https://bugbountylibrary.com/r/h1%3A470547.md), or read stored addresses and deanonymize users [E3](https://bugbountylibrary.com/r/h1%3A430854.md). Severity rises when the injected interface reaches a privileged process (avp.exe) or when protections can be silently turned off. Partial hardening of a few globals made the exposure worse by creating false confidence [E2](https://bugbountylibrary.com/r/h1%3A470547.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A470544.md
- E2: https://bugbountylibrary.com/r/h1%3A470547.md
- E3: https://bugbountylibrary.com/r/h1%3A430854.md