Executive brief
Toggl Track is a Chrome browser extension that helps users log and track their work time. The extension fails to properly validate the origin of certain messages sent to it, allowing a malicious webpage to send forged messages that can force the user to be logged out and lose time tracking data, or trigger other unintended actions in the extension.
Technical details
The vulnerability is a missing origin validation (CWE-346) in a postMessage handler within Toggl Track's content script. The handler checks that event.source === window and that event.data.direction is either "from-webapp" or "from-public-web", but does not validate event.origin. An attacker-controlled page-level script running in the same frame can satisfy these insufficient checks and forge session-state messages such as logout, login-success, or user-loaded. This allows an attacker to manipulate the extension's session state without authentication, including forcing logout, disrupting time tracking, or injecting user IDs into verification flows. The attack is remotely exploitable and does not require user interaction beyond visiting a malicious page. No patch information is currently available; the vendor has not responded to early disclosure notification.
Affected products
- Toggl OÜ Toggl Track 4.11.16
Timeline
- 2026-08-31: disclosed
- other: Exploit details published on GitHub; vendor did not respond to early notification