posta

Posta Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessage vulnerabilities, and includes features such as replaying messages sent between windows within any attached browser. Prerequisites Google Chrome / Chromium Node.js...

posta

Posta Posta es una herramienta para investigar la comunicación de Mensajería entre Documentos Cross-document Messaging. Permite rastrear, explorar y explotar vulnerabilidades de postMessage, e incluye funciones como la reproducción de mensajes enviados entre ventanas dentro de cualquier navegador...

PwnFox

PwnFox PwnFox es una extensión de Firefox/Burp que proporciona herramientas útiles para tu auditoría de seguridad. Si eres usuario de Chrome, puedes visitar https://github.com/nccgroup/autochrome. PwnFox Funcionalidades Un solo clic en BurpProxy Perfiles de Contenedores Registrador de PostMessage...

html-poc

Código de prueba de concepto para vulnerabilidades del lado del cliente Pruebas de concepto básicas en HTML para problemas como: Clickjacking Configuración insegura de CORS CSRF Tabnapping XSSI Problemas con postMessage La mayoría de estas son bastante básicas, pero tenerlas todas en un solo luga...

advisories

Sobre mí Twitter: @justinsteven Blog: https://www.justinsteven.com/ Avisos de seguridad Listados en orden cronológico inverso. Haz clic en cualquier título para leer el aviso completo. Gartner Peer Insights Widget postMessage DOM XSS Fecha de divulgación: 2023-02-03 El Gartner Peer Insights Widge...

CVE-2026-82811

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82809

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is...

CVE-2026-82811

CVE-2026-82811 affects the Toggl Track Chrome extension (version 4.11.16 ). The vulnerability resides in the extension's postMessage Handler , which fails to properly validate message origins, allowing an attacker to accept forged session-state messages through an unauthenticated handler. The att...

EUVD-2026-68679

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

CVE-2026-82811 Toggl OÜ Toggl Track Extension postMessage origin validation

A security vulnerability has been detected in Toggl OÜ Toggl Track Extension 4.11.16. This affects an unknown function of the component postMessage Handler. The manipulation leads to origin validation error. It is possible to initiate the attack remotely. The exploit has been disclosed publicly a...

EUVD-2026-68656

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is...

CVE-2026-82809 vidIQ Vision for YouTube Extension postMessage window.addEventListener information disclosure

A security flaw has been discovered in vidIQ Vision for YouTube Extension 3.199.0 on Chrome. The affected element is the function window.addEventListener of the component postMessage Handler. Performing a manipulation of the argument vidiqEvent results in information disclosure. The attack is...

CVE-2026-82809

vidIQ Vision for YouTube Extension 3.199.0 on Chrome contains an information disclosure vulnerability in the postMessage Handler component, specifically in the window.addEventListener function. Manipulating the vidiqEvent argument allows a remote attacker to access sensitive data without authenti...

Astra Linux – Vulnerability in Firefox

Mitigation bypass in the DOM: PostMessage component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

CVE-2026-15580

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...

CVE-2026-15580

N-able PassPortal browser extension (Chrome and Edge) is vulnerable to vault token disclosure via an unvalidated postMessage handler. Any site or iframe presented to the user could gain complete, persisted access to the decrypted vault for up to 100 days, enabling authentication abuse. The issue ...

EUVD-2026-63972

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...

CVE-2026-15580 PassPortal browser extension: vault token disclosure via unvalidated postMessage

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...

CVE-2026-19992

A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A...

CVE-2026-19992 Orange View Limited DualSafe Password Manager & Digital Vault Extension postMessage-based Bridge information disclosure

A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A...