postMessage abuse

When it applies

The target sends or receives postMessage between windows/iframes (SSO, payment widgets, chat, embeds). A receiver that doesn't validate the sender's origin will act on a message from your page.

Why it works

postMessage is cross-origin by design; safety depends entirely on the receiver checking event.origin and the sender setting a specific targetOrigin. Miss the origin check and any site can drive the handler; use targetOrigin="*" and any embedder can read the message. Then it's just a matter of what the handler does with event.data — often innerHTML, eval, location, or a relayed token.