mobile.yahoo.com - postMessage Origin Bypass to DOM XSS

Exploit Configuration

Attacker Origin:

Target: https://mobile.yahoo.com

Vulnerable Regex: /https:\/\/(.+[.])?pfs.yahoo.com(:[0-9]+)?/

Regex Match Result:

Attack Steps

1. Open mobile.yahoo.com in a new window
2. Send postMessages with redirect command (every 500ms)
3. Waiting for victim to hover/tap profile area...
4. XSS triggers via window.location = javascript:...

Payload:

Log