# PostMessage Vulnerabilities ## **PostMessages wildcards** **PostMessage** uses the following function to send a message: ```javascript targetWindow.postMessage(message, targetOrigin, [transfer]); ``` Check that **targetOrigin** could be a url like , so the messages can only be sent to that user (secure). Or it cloud be a wildcard "**\***". In case a wildcard is used, messages could be sent to any domain. ### Attack In [**this report**](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/) you can read how you could **iframe a page** that at some point may **sent** a **postmessage** using a **wildcard as targetOrigin** and **modify it's location so the data will be sent to an arbitrary domain**. In order to be able to perform this attack **X-Frame header must not be present** in the vuln page. ```markup