postMessage wildcard
window.addEventListener('message', ...) that trusts event.data without a strict event.origin allowlist. Pair it with a sender that uses targetOrigin '*'.
Tags: postmessage, xss, ato, spa
Typical severity: P3-P4
What it becomes
Listener with origin '*' or a weak startsWith check plus a DOM / auth sink is a classic SPA gadget.
Where to look
SSO popupspayment iframesmobile WebViewswidget embedsfile-preview frames
Chains
- XSS — data.html or data.url lands in innerHTML, document.write, or a script src.
- ATO — data.token / data.user is applied to localStorage or a parent auth store.
- UXSS-lite — Opener from a target page you can XSS (or an open redirect) posts into a privileged listener on another origin of the same program.
Notes
- Always dump every listener and every window.opener / iframe postMessage in the JS review.
- Sandbox + allow-same-origin iframes change the origin to null; many allowlists forget null.