# Delayed extension result reaches a different document

An asynchronous extension operation reuses stale tab/frame authority after navigation and exposes a protected result to another document.

**Candidate CWE:** [CWE-367](https://cwe.mitre.org/data/definitions/367.html) · [CWE-863](https://cwe.mitre.org/data/definitions/863.html)

## Test hypothesis

Pause a local mock response after authorizing the original page, navigate the same tab to another controlled origin, then release it. Compare unchanged-document and denied-origin controls.

## Evidence required

Record initiating and receiving origin/document IDs, event order, original grant, response route and the seeded private marker received by the unintended document.

## Rule out false positives

Dropped messages, responses retained only by the original authorized document, and intentionally public data do not show disclosure. Confirm the browser version supports the metadata used in the claim.

## Playbook and command references

- [Browser extensions: message authority and document lifetime](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/extension-message-boundaries.html) — Trace real page messages into extension capabilities and test sender identity, navigation races, permission changes and worker restarts.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Browser%20extensions%3A%20message%20authority%20and%20document%20lifetime)

## Referenced by these target playbooks

[Desktop & extensions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/desktop.html) · [Web & API](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/web-api.html) · [OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the [mapping guide](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html).

## Primary references

- [Chrome MessageSender identity](https://developer.chrome.com/docs/extensions/reference/api/runtime#type-MessageSender)
- [Chrome document-targeted tab messaging](https://developer.chrome.com/docs/extensions/reference/api/tabs#method-sendMessage)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)