Proctorio Chrome Extension Insufficient Origin Validation in PostMessage Handlers Vulnerability

A vulnerability exists in the Proctorio Chrome Extension due to multiple message event handlers that fail to properly validate the origin of incoming messages. The issue arises because the internal messaging bridge processes messages based solely on the presence of a 'fromWebsite' property, without verifying the 'event.origin' attribute. This flaw allows unauthorized interaction with the extension's functionality.

Impact

Exploitation of this vulnerability could enable a malicious webpage to send crafted postMessage payloads to the extension's background script, potentially allowing for unauthorized actions or data manipulation within the extension.

Remediation

Proctorio has deployed a fix for this vulnerability. Users are encouraged to update to the latest version of the Proctorio Chrome Extension.