1. I go to a job interview at a company that uses a chromebook with a restricted account. The interviewer sits next to me as I go through the process.
2. As we go through the steps in a google document, I need something from my resume on my website. I fumble with the URL bar slightly which hopefully has the doc ID, possibly because I once closed the document "by accident" and brought it back up.
3. While discussing whatever brought us to my website, I click on something but act like I am switching tabs.
4. At the end of the process in their document, I point out how strange the Google Docs looks now and press the feedback button to show my corporate soft skills.
5. The companies hiring interview document is now floating around my school and in 10 years half of their engineering is my Alma Mater.
1. You need to know the document ID you're targeting (Stack Exchange once worked the ID out to ~256 bits).
2. You have to get the victim to interact with a Google doc on a site that you control (you need to re-dress the Google Docs interface, get the victim to your site, and then have them treat your site as if it was Google Docs).
3. You need to get the victim to use the Google feedback feature in order to trigger the vulnerable postMessage.
What's a scenario in which an attacker gets these stars to align? (I'm sure there is one).