Attacker origin

Attack surface

Every page here runs on a different origin from the portal, which is the whole point: a postMessage handler that trusts "*" (or a sloppy origin check) will accept these.

Scenario	Page	Needs this origin	Result

Victim application

Open it in another tab so you can watch both sides at once.