Collected research

The Postman Always Rings Twice: Attacking and Defending postMessage in HTML5 Websites

Sooel Son and Vitaly Shmatikov · NDSS Symposium

A Chrome extension called RVSCOPE hooked addEventListener across the Alexa top 10,000 and harvested 136 distinct postMessage receivers used by 2,245 hosts. 65 did no origin check at all and 14 checked with broken regular expressions, giving script injection or local-storage writes on 84 sites. Two defences follow: a pseudo-random token carried in the frame src, and a CSP msg-src extension.

Record

Researcher

Sooel Son and Vitaly Shmatikov

Published by

NDSS Symposium

Topic

Other

In the archive

• Collected in the 2013 research round

Tags

• postmessage
• xss
• same-origin-policy
• sop-bypass
• measurement-study
• large-scale-scan
• csp
• iframe
• mitigation
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Sooel Son and Vitaly Shmatikov, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.