CROSS-WINDOW-MESSAGE ORIGIN VALIDATION

Summary from the TLDR InfoSec newsletter

A vulnerability in Facebook/Meta's Canvas on the Comet platform could allow account takeover if a user plays a malicious Canvas game. The issue stems from Compat iframes used for OAuth dialogs. A malicious game could exploit cross-window messaging with the parent window to set up a rogue communication channel and take over the account. This blog post explains how the exploit works with examples.