> Apparently https://ssl.comodo.com/ https://ssl.comodo.com/ used to then proceed to execute that code. However, this is not a vulnerability in the browser, but

> Apparently https://ssl.comodo.com/ https://ssl.comodo.com/ used to then proceed to execute that code. However, this is not a vulnerability in the browser, but in that website. Am I missing something? Was Chromodo breaking the `messageEvent.origin` property, breaking same-origin checks in JavaScript? Seems far-fetched. I believe it's neither of these - I think the claim being made is that Chromodo installs a custom event listener for MessageEvents in all websites, which exposes a handful of APIs, including "execCode" and "callOuterFunction". If you look at the sample exploit (https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=225988 https://bugs.chromium.org/p/project-zero/issues/attachmentTe...), while it defaults to ssl.comodo.com, you can specify an arbitrary website. (Also, if this were indeed a website bug, this would have been reproducible in normal browsers.) We would need to find a vulnerable version of the Chromodo browser to confirm this.