F-001 PoC — Tea SDK postMessage substring origin bypass

Origin:

Target

Message to send

Raw text sent verbatim via popup.postMessage(text, "*"). Tea SDK's pi() parses the data field as JSON if it's a string, so it accepts both JSON-string and other formats.

Message body (one line):

F-001 PoC — Tea SDK postMessage substring origin bypass

Target

Message to send

Presets — click to load into the textarea above

Log

F-001 PoC — Tea SDK postMessage substring origin bypass

Target

Message to send

Presets — click to load into the textarea above

Log Clear

Log