window.console can be overridden by extension content scripts

Fixed, not yet flighted Issue #11333557

Details

Created
Mar 20, 2017
Privacy
This issue is public.
Reports
Reported by 0 people

Sign in to watch or report this issue.

Steps to reproduce

  1. It’s possible to
    change properties of page-window object in the content script.

Steps to reproduce are simple:

Create and load a simple extension with content script:

window[‘console’] = {abc:123, log: function
(msg){alert('Console.log: '+msg); }};

and then open a test page:

<html>

<body>

<script>

  setTimeout(function(){

    console.log(‘Test - timer’); // fails by ‘SCRIPT16389:
Unspecified error.’

  }, 500);

</script>

</body>

</html>

Attachments

0 attachments

    Comments and activity

    • Microsoft Edge Team

      Changed Assigned To to “Scott S.”

      Changed Status to “Confirmed”

      Changed Steps to Reproduce

      Changed Steps to Reproduce

      Changed Status from “Confirmed” to “In progress”

      Changed Status from “In progress” to “In code review”

      Changed Assigned To from “Scott S.” to “Scott L.”

      Changed Status from “In code review” to “Fixed”

      Changed Status from “Fixed” to “Fixed, not yet flighted”

    You need to sign in to your Microsoft account to add a comment.

    Sign in