oteOrgHost; // Parse the URL to ensure correct handling of host value const url = new URL(dgServiceHost); const host = url.hostname; const regex = new RegExp( /^(?:[a-zA-Z0-9-]+\.)*degreed\.(?:com|app|dev)$/ ); // Check if the host ends with any of the specified domains const isValidMatch = host.match(regex); if (!(isValidMatch?.[0] === host)) { return; } // build trustedFrameUrl with service host from chrome storage chrome.storage.sync.set({ dgServiceHost: dgServiceHost }, () => { d.getElementById(iframeId).setAttribute( 'src', `${dgServiceHost}/${trustedFrameUrlPrefix}` ); }); } else if (parsed && parsed.APP_READY) { sendMessageToContentScript(HIDE_LOADER_EVENT); sendMessageToContentScript(APP_READY_EVENT); } else { tryRelayMessage(event.data); } } });26:T5a1,// trusted/trusted-frame-helper.js:85 window.addEventListener('message', function (event) { // MISSING: no `if (event.origin !== 'https://degreed.com') return;` // The listener trusts the message regardless of which window posted it. // Because trusted-frame-proxy.html is web_accessible to http://*/* and https://*/*, // ANY page on the internet can embed it in an iframe and post messages to it. let parsed; try { parsed = JSON.parse(event.data); } catch (e) {} if (parsed?.dgCloseWindow) { // Closes the Degreed sidebar in the user's active tab. Annoyance / DoS. sendMessageToContentScript('CLOSE_SLIDER_FROM_X'); } if (parsed?.resetIframeHost) { // Validates the SHAPE of the supplied host (must look Degreed-ish) // but does NOT validate the SENDER. An attacker who controls // evil.degreed.com (e.g. via a dangling subdomain take-over) passes this check. const url = new URL(parsed.remoteOrgHost); if (!/^(?:[a-zA-Z0-9-]+\.)*degreed\.(?:com|app|dev)$/.test(url.hostname)) return; // Persists the attacker-supplied URL as the API host the Degreed UI talks to. chrome.storage.sync.set({ dgServiceHost: parsed.remoteOrgHost }, () => { document.getElementById('__degreed-extension__') .setAttribute('src', `${parsed.remoteOrgHost}/degreed-button/app?is_ext=true`); }); } // tryRelayMessage forwards every other message verbatim to the inner iframe. });27:T5de, Degreed Frame PoC

Degreed Frame PoC

Watch the console. Then check chrome.storage.sync from the extension's service worker DevTools (chrome://extensions → Degreed → service worker).

20:["$","section",null,{"className":"mb-8","children":[["$","h2",null,{"className":"text-foreground mb-3 text-sm font-semibold tracking-wide uppercase","children":"Findings"}],["$","div",null,{"className":"grid gap

Is Degreed Extension safe?

Findings