#vulns.co
/
mcp by GKData.io

← Back to Gadgets

postMessage wildcard

window.addEventListener('message', ...) that trusts event.data without a strict event.origin allowlist. Pair it with a sender that uses targetOrigin '*'.

Tags: postmessage, xss, ato, spa

Typical severity: P3-P4

What it becomes

Listener with origin '*' or a weak startsWith check plus a DOM / auth sink is a classic SPA gadget.

Where to look

  • SSO popups
  • payment iframes
  • mobile WebViews
  • widget embeds
  • file-preview frames

Chains

  • XSS — data.html or data.url lands in innerHTML, document.write, or a script src.
  • ATO — data.token / data.user is applied to localStorage or a parent auth store.
  • UXSS-lite — Opener from a target page you can XSS (or an open redirect) posts into a privileged listener on another origin of the same program.

Notes

  • Always dump every listener and every window.opener / iframe postMessage in the JS review.
  • Sandbox + allow-same-origin iframes change the origin to null; many allowlists forget null.

← Back to Gadgets