Loading vulnerability…
PostMessage origin validation flaw leading to stored XSS in Foxit webplugins embedded calculator
A stored cross-site scripting vulnerability exists in webplugins.foxit.com within an embedded calculator component’s window.postMessage handler. The handler performs origin validation incorrectly by checking an attacker-controlled field (t.data.origin) rather than the browser-enforced event.origin. It then uses attacker-supplied data to set an externalPath value that is directly assigned as the source of a loaded script, enabling injection of a remote <script> into a trusted Foxit domain context when a crafted postMessage is received.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary JavaScript execution in the context of the trusted webplugins.foxit.com origin. This can enable session/token theft, account takeover workflows, and other same-origin impacts against users interacting with the affected Foxit web plugin content.
If you can’t patch tonight, do this now.
Deploy/strengthen CSP on webplugins.foxit.com to restrict script-src to trusted, non-user-controllable origins and disallow unsafe dynamic script loading where possible. As a defense-in-depth measure, add runtime message schema validation and logging/alerting for unexpected postMessage traffic patterns targeting the calculator component.
Patch, then assume compromise.
Fix the postMessage handler to validate the sender using event.origin (and optionally event.source) against a strict allowlist, and reject messages that do not match expected origins and schemas. Additionally, prevent script-source assignment from untrusted message data (e.g., remove dynamic script injection or enforce a hardcoded/allowlisted set of script URLs).
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.