", "data": message.data }, function (response) { log("Enabled superstarter!"); window.postMessage(JSON.stringify({ event: "superstarter", status: "started", data: "manual" }), "*"); setLaunchStatus({ launchStatus: "started", launchType: "manual", launchMethod: "superstarter" }); //alert("Enabled superstarter!"); } ); } break; } } } window.addEventHandler("message", receiveMessage);26:T7e7, SuperNova SWF Enabler – postMessage origin check PoC

SuperNova SWF Enabler — postMessage PoC

This page sends a single window.postMessage and prints any reply from the SuperNova content script. If a reply appears, the extension accepted a command from this origin (which is unrelated to SuperNova).

Replies received from the extension:

(none yet)

27:T55a,**Confirmed reachable today:** Any web page you visit can send a postMessage that the extension's content script will accept and forward to its background service worker. We observed this end-to-end against a live install on an unrelated origin (https://example.com). **Conditional on the native host being installed:** The forwarded `superstarter` command reaches `chrome.runtime.sendNativeMessage('com.tacticstechnology.superstarter', ...)`. If the SuperStarter native messaging host is installed on your computer, that means a webpage you visit can pass arbitrary `swfurl` and `flashvars` strings to the local helper. We did not have the native host installed during testing, so we did not exercise what the helper does with those arguments — only that the message reaches the `sendNativeMessage` call. **Always reachable, even without the native host:** The `loggame` branch in content.js:291 invokes `logGame(message.data)` with arbitrary attacker-supplied object data. Any page can trigger it. **The fix is one uncommented line.** Removing the `//` from `if (e.source != window) return;` at scripts/content.js:419 would restrict the listener to messages originating from the extension's own page context. The developer comment on that same line — `//FIXME: Anyone can post commands` — indicates the author was aware of the gap when shipping the extension.20:["$","section",null,{"className":"mb-8","children":[["$","h2",null,{"className":"text-foreground mb-3 text-sm font-semibold tracking-wide uppercase","children":"Findings"}],["$","div",null,{"className":"grid

Is SuperNova SWF Enabler safe?

Findings