CVE-2026-76894

The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via "postMessage". Its inbound "message" listener performs no "event.origin" validation, and its outbound messages are sent with target origin "''". Any window/frame able to...