# Unescaped data in privileged page context

Attacker data reaching privileged HTML, evaluateJavaScript, or native bridges without escaping or origin checks

_Area: Web injection and code execution. Seen in 4 disclosed reports; one confirmed bounty: $40,000; latest 2023-06-22. Updated 2026-10-24._

## How it works
A privileged surface (browser-internal page, native bridge, injected user script) treats data from ordinary web content as trusted. The assumption that breaks: that titles, cookies, query params, or postMessage fields are inert text. When that data is concatenated into HTML or into a JS string that runs in a privileged context, the attacker's markup or code executes with the page's or app's authority, not the origin's.

## Where it shows up
- Page titles, cookies, or URL params rendered into browser-internal pages (new tab, settings, error pages) without encoding [E1](https://bugbountylibrary.com/r/blog%3Aleucosite-com-edge-chromium-eop-rce.md)
- `postMessage` handlers that accept calls from cross-origin subframes without validating the sender origin [E2](https://bugbountylibrary.com/r/h1%3A993670.md)
- Any parameter passed into `evaluateJavaScript` or string-interpolated into executed JS [E2](https://bugbountylibrary.com/r/h1%3A993670.md)[E3](https://bugbountylibrary.com/r/h1%3A1436558.md)
- Secret tokens (securityToken, messageHandlerToken) embedded in page-readable JS prototypes [E3](https://bugbountylibrary.com/r/h1%3A1436558.md)
- Attacker-controlled fields (nodeTag, JSON fields) concatenated into JS run on the main frame [E1](https://bugbountylibrary.com/r/blog%3Aleucosite-com-edge-chromium-eop-rce.md)[E3](https://bugbountylibrary.com/r/h1%3A1436558.md)
- Undocumented privileged APIs reachable from web origins but not from `edge://` pages [E1](https://bugbountylibrary.com/r/blog%3Aleucosite-com-edge-chromium-eop-rce.md)

## How to review
Trace every value from web content to a privileged sink. The invariant: data crossing from untrusted origin into a privileged context must be origin-checked at the boundary and encoded for its destination (HTML-escape for markup, JS-escape or structured passing for script). For native bridges, confirm the handler validates the calling frame's origin and that no parameter reaches `evaluateJavaScript` unescaped [E2](https://bugbountylibrary.com/r/h1%3A993670.md). For injected scripts, confirm no secret token is placed where page JS can read it [E3](https://bugbountylibrary.com/r/h1%3A1436558.md). For privileged APIs, confirm attacker-controlled fields are validated before dereference [E1](https://bugbountylibrary.com/r/blog%3Aleucosite-com-edge-chromium-eop-rce.md).

## Variants seen
- Reflected title and cookie into privileged NTP HTML, plus unsafe dereference in a privileged navigate API [E1](https://bugbountylibrary.com/r/blog%3Aleucosite-com-edge-chromium-eop-rce.md)
- Cross-origin subframe triggering a native handler whose version param flows unescaped into `evaluateJavaScript` [E2](https://bugbountylibrary.com/r/h1%3A993670.md)
- Leaked tokens plus concatenated nodeTag yielding UXSS on any domain [E3](https://bugbountylibrary.com/r/h1%3A1436558.md)

## Impact and severity
All three yielded universal XSS in privileged context; E1 escalated toward EoP and potential RCE. Severity is high because the execution context outranks any web origin, so one injection crosses site boundaries. Missing origin checks and leaked tokens widened reach; undocumented privileged APIs made escalation worse [E1](https://bugbountylibrary.com/r/blog%3Aleucosite-com-edge-chromium-eop-rce.md)[E2](https://bugbountylibrary.com/r/h1%3A993670.md)[E3](https://bugbountylibrary.com/r/h1%3A1436558.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aleucosite-com-edge-chromium-eop-rce.md
- E2: https://bugbountylibrary.com/r/h1%3A993670.md
- E3: https://bugbountylibrary.com/r/h1%3A1436558.md