Impact

Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted.
This is not a big impact because it happens only on the same browser.

Patches

It has been patched in version 1.10.0

Workarounds

The only workaround is to not send sensitive information with sysend messages.

References

• Leaking of potentially sensitive user information on Cross-Domain communication

For more information

If you have any questions or comments about this advisory:

• Comment on issue #33
• Email me at [email protected]