Refiner widget — missing-origin-check postMessage → CSS injection

What this proves. This page is served from the attacker origin refiner-poc.noxian.io. It embeds Refiner's render iframe from js.refiner.io and sends it {sender:"refiner", customStyles:<css>}. The render iframe's message listener (app.641b5303.js, registered in Proxy.mounted) performs no event.origin check — it only checks the cosmetic sender:"refiner" tag. It passes customStyles through kl() (a 7-token denylist that does not block url() / @font-face / attribute selectors) and injects it via style.textContent. The injected CSS then fires callbacks to /cb on this same host — proving arbitrary CSS execution inside the js.refiner.io origin, from a cross-origin attacker page.