CVE-2026-76894

Summary

Affected code

window.addEventListener('message', function (event) {
 var msg = event.data;          // no check of event.origin
 if (!msg || typeof msg !== 'object') return;
 if (msg.id !== undefined && pending[msg.id]) { ... resolve/reject pending MCP request ... }
 ...
 if (data && (data.fields || data.records)) initTable(data);  // renders attacker-supplied data
});

// outbound:
window.parent.postMessage({ jsonrpc: '2.0', id: id, method: method, params: params || {} }, '*');
mcpNot: window.parent.postMessage({ jsonrpc:'2.0', method:method, params:params||{} }, '*');

Impact

• Content spoofing. A frame that can postMessage to the UI can supply arbitrary fields/records, causing the table to render fabricated rows and links (e.g. a phishing link url) that appear to come from the queried portal. (Values are HTML-escaped, so this is display spoofing, not script injection — no XSS.)
• Handshake/UX interference. Because inbound messages matching a pending id resolve/reject the UI's MCP requests, an attacker frame can spoof responses to the ui/initialize handshake or otherwise disrupt the panel.
• Outbound leakage. Posting to '*' means the UI's JSON-RPC messages are delivered to whatever the parent origin is; if the resource is ever embedded by a context other than the trusted host, those messages leak to it.

Proof of concept

• poc/verify-no-origin-check.mjs — static confirmation that the listener has no origin check and outbound uses '*':

[x] validates event.origin       : NO
[x] outgoing postMessage targetOrigin : '*' (any)
RESULT: VULNERABLE

• poc/parent-spoof-poc.html — a page that embeds the UI and injects fabricated rows cross-origin with no handshake; the UI renders them.

Remediation

• Validate event.origin against the expected host origin on every inbound message; drop messages from other origins.
• Send outbound postMessage with an explicit target origin (the host origin established at initialize time) instead of '*'.
• Optionally, bind to a nonce/channel established during ui/initialize so only the negotiated host can drive the panel.