Severity
Low (defense-in-depth; not exploitable today — there is no external message surface).
Items
- The MessageBus dispatches purely on
message.type; SF_EXECUTE_ANONYMOUS, SF_API_REQUEST, and DATA_IMPORT (which overwrites storage keys unvalidated) are reachable from any extension context (src/services/messaging/index.ts:154-178, src/services/storage/index.ts:581-608). Restrict Apex/raw-API/import handlers to message.source === 'app' | 'popup' and validate imported shapes.
activeTab permission is redundant — the extension already holds persistent Salesforce host permissions plus tabs (public/manifest.json:10). Drop it for least-privilege (update docs/CHROME_WEB_STORE.md justifications to match).- Minor hygiene:
UI_SETTINGS_SET and STORAGE_PURGE_OLD error paths return bare {success: false} with no error or requestId (src/background/index.ts:568-576, :895-899).
Environment
Commit 74cf21b (main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).
Severity
Low (defense-in-depth; not exploitable today — there is no external message surface).
Items
message.type;SF_EXECUTE_ANONYMOUS,SF_API_REQUEST, andDATA_IMPORT(which overwrites storage keys unvalidated) are reachable from any extension context (src/services/messaging/index.ts:154-178,src/services/storage/index.ts:581-608). Restrict Apex/raw-API/import handlers tomessage.source === 'app' | 'popup'and validate imported shapes.activeTabpermission is redundant — the extension already holds persistent Salesforce host permissions plustabs(public/manifest.json:10). Drop it for least-privilege (updatedocs/CHROME_WEB_STORE.mdjustifications to match).UI_SETTINGS_SETandSTORAGE_PURGE_OLDerror paths return bare{success: false}with noerrororrequestId(src/background/index.ts:568-576,:895-899).Environment
Commit
74cf21b(main), WaveLink 0.6.0. Found in the 2026-08-31 adversarial audit (code-verified).