origin validation

Zero-Click postMessage Origin Bypass — from the canvas to credit drain

The postMessage listener only validated a field of e.data — controlled by the attacker. e.origin was never checked. From an iframe loaded when opening a bot, messages injected as if the victim had written them.