peach-browser / c3c0d13e0280

fix: gate key-material and pairing handlers to extension-page senders (v4.8.2) Codex Security 2026-08-04 HIGH (broken-access-control.sensitive-message-handler-gating): GET_ADOPTION_MATERIAL (returns root key) and COMPLETE_PAIRING (registers device, lifts revocation, triggers sync) were reachable from any content script with only vault.isUnlocked(). COMPLETE_FIREFOX_PASSKEY_CREATE is gated here as well ahead of its ceremony-binding fix. Fix: extend the PCH-01-018 sender-origin gate (DESTRUCTIVE_MESSAGE_TYPES -> PRIVILEGED_MESSAGE_TYPES) to all three types. Zero legitimate content-script senders exist; adoption runs in-background via relay-adoption-bg.ts. Regression test covers content-script rejection + extension-page pass-through.

dev · 3 weeks ago · 2026-08-04 · 5.8 MB

parent: 8eb049c60fd8