f57cf4c894
The isolated-world relay accepted any postMessage carrying the fixed tag "aegis-aegis", including one from a cross-origin iframe (an ad, an embed), and attributed it to the top-level origin and its grants. The tag now carries a per-load random nonce that only the injected main-world bridge knows, and both listeners drop events whose source is not this window. The document_start install path is unchanged. |
||
|---|---|---|
| .. | ||
| aegis | ||
| blocker | ||
| consent | ||
| docx-editor | ||
| notepad | ||
| pdf-editor | ||
| pithos | ||
| screenshot | ||
| translate | ||
| vpn | ||