*update looks like hashie had control of email since it was started
https://code.google.com/p/chromium/issues/detail?id=429395 Security: Window.opener bypasses same origin policy
1 person starred this issue and may be notified of changes. Back to list
Status: WontFix
Owner: ----
Closed: Nov 2
Type-Bug-Security
Add a comment below
Reported by
ad...@glados.cc, Oct 31, 2014
VULNERABILITY DETAILS
Opened windows (through normal hrefs with target="_blank") can modify window.opener.location and replace the parent webpage with something else, even on a different origin (bypassing same origin policy).
While this doesn't allow script execution, it does allow phishing attacks that silently replace the parent tab (which a user already mentally trusts).
window.opener.location should not be modifiable if on a different origin.
VERSION
Chrome Version: 37.0.2062.94 + stable
Operating System: Ubuntu
REPRODUCTION CASE
https://hashie.co/chrome/demo.htmlThat could have been someone completely different just using that as their username there. It's not though. It is TradeFortress as the same user made an earlier post
So, there's now a definite link between TradeFortress and hashie. Interesting.