Message Handling Vulnerability in React Developer Tools Extension by Meta

CVE-2023-5654

What is CVE-2023-5654?

The React Developer Tools extension contains a vulnerability due to improper handling of messages received from webpage contexts. An active message listener allows any webpage to send requests that the extension processes without validating or sanitizing incoming URLs. This vulnerability enables a malicious webpage to exploit the user's browser and manipulate requests to arbitrary URLs, potentially leading to unauthorized access or data leakage.

References