PwnFox

PwnFox PwnFox is a Firefox/Burp extension that provide usefull tools for your security audit. If you are a chrome user you can check https://github.com/nccgroup/autochrome. PwnFox Features Single click BurpProxy Containers Profiles PostMessage Logger Toolbox Security header remover Installation...

posta

Posta Posta is a tool for researching Cross-document Messaging communication. It allows you to track, explore and exploit postMessage vulnerabilities, and includes features such as replaying messages sent between windows within any attached browser. Prerequisites Google Chrome / Chromium Node.js...

html-poc

Proof of concept code for client-side vulnerabilities Basic HTML proof of concepts for issues such as: Clickjacking insecure CORS settings CSRF Tabnapping XSSI postMessage issues Most of these are pretty basic, but having them all in one place avoids writing the same things over and over again. T...

EUVD-2026-111475

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

CVE-2026-118129

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

CVE-2026-118129

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

CVE-2026-118129 jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

CVE-2026-118129

A vulnerability exists in jeremyckahn Chitchatter (up to commit f82538633813c854a81a8b2112a2f6ba17b39cbc ) within the PostMessage Handler component. The isConfigMessageEvent function in the src/Bootstrap.tsx file is susceptible to improper authentication due to the manipulation of the parentDomai...

CVE-2026-118129 jeremyckahn Chitchatter PostMessage Bootstrap.tsx isConfigMessageEvent improper authentication

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

PT-2026-127255

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview storybook is a frontend workshop for building UI components and pages in isolation. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/addon-mcp is a Help agents automatically write and test stories for your UI components Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, whi...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/addon-vitest is a Storybook Vitest addon: Blazing fast component testing using stories Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, whi...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/core is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not validate the origin of incoming...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/core-server is a Storybook framework-agnostic API Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not validate the origin of...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @storybook/experimental-addon-test is an Integrate Vitest with Storybook Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the postMessage channel handler in code/core/src/channels/postmessage/index.ts, which does not validate the...

CLSA-2026-1792471629 TuxCare security update for @storybook/channel-postmessage (1 CVE)

TuxCare rebuilt @storybook/channel-postmessage to address 1 CVE. Fixed in 7.0.7-tuxcare.1...

CVE-2026-76894

The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via "postMessage". Its inbound "message" listener performs no "event.origin" validation, and its outbound messages are sent with target origin "''". Any window/frame able to...

ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

Summary The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to...

GHSA-VQFF-R82H-9CRC ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

Summary The MCP Apps UI resource an interactive DataStore table rendered in the host's webview/iframe communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to...