Delayed extension result reaches a different document
An asynchronous extension operation reuses stale tab/frame authority after navigation and exposes a protected result to another document.
Candidate CWE: CWE-367 · CWE-863
Test hypothesis#
Pause a local mock response after authorizing the original page, navigate the same tab to another controlled origin, then release it. Compare unchanged-document and denied-origin controls.
Evidence required#
Record initiating and receiving origin/document IDs, event order, original grant, response route and the seeded private marker received by the unintended document.
Rule out false positives#
Dropped messages, responses retained only by the original authorized document, and intentionally public data do not show disclosure. Confirm the browser version supports the metadata used in the claim.
Playbook and command references#
- Browser extensions: message authority and document lifetime — Trace real page messages into extension capabilities and test sender identity, navigation races, permission changes and worker restarts.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the mapping guide.