Collected research

Securing Frame Communication in Browsers (postMessage target-origin security)

Securing Frame Communication in Browsers

Adam Barth, Collin Jackson and John C. Mitchell · usenix.org

Shows permissive and window frame-navigation policies allow cross-window and gadget-hijacking attacks (Google AdSense login, iGoogle), and gets the descendant policy shipped in Firefox 3 and Safari. Then breaks both inter-frame channels: fragment-identifier messaging in Microsoft.Live.Channels and SMash falls to a Needham-Schroeder/Lowe impersonation, and postMessage leaks messages to a frame navigated away first — fixed by targetOrigin.

Record

Document

Securing Frame Communication in Browsers

Researcher

Adam Barth, Collin Jackson and John C. Mitchell

Published by

usenix.org

Topic

Browser

In the archive

• Collected in the 2008 research round

Tags

• iframe
• same-origin-policy
• sop-bypass
• postmessage
• formal-analysis
• mitigation
• phishing
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of Adam Barth, Collin Jackson and John C. Mitchell, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 8 August 2026.