Vviers

A user visiting a malicious document or submitting a malicious form could have their account compromised due to the ability to use the `javascript:` scheme with custom widget URLs and form redirect URLs.

The issue concerns a spreadsheet hosting server where a user's account could be compromised by visiting a malicious document and previewing an attachment. This happens because JavaScript in an SVG file is evaluated in the context of the user's current page, allowing for potential account takeover.

The issue arises when a user visits a malicious document and clicks on a link in a HyperLink cell using a control modifier, such as Ctrl+click. This could lead to account compromise, as the link could use the javascript: scheme and be evaluated in the context of their current page.