How should browsers mitigate Proxy-related security issues? · Issue #272 · tc39/ecma262

TC39 discuss about potential security issue of ES6 Proxy.

There’s a security issue on the web with ES2015 Proxies where a cross-origin request can be made to load some ECMAScript code, and this request can leak some information across origins due to the existence of Proxies.

POC on Chrome:

<script> window.__proto__ = Proxy.create({ get: function(target, name) {console.log("data=" + name)} }); </script> <script src="http://victim/test.csv"></script> 

Firefox lock down Object.prototype.

This issue is similar to JSON Hijacking.