Chrome Extension breaks Chase website

[cesmoak]

Description

Logging into chase.com is broken when the new Chrome extension is enabled. My guess is that it breaks other sites, too.

Reproduction steps

1. Install/enable the chrome extension.
2. Attempt to log in at chase.com
3. Get the following repeated several times in console (various stack traces, but ends up here):

DevTools: Error dispatching event: DataCloneError: Failed to execute 'postMessage' on 'Window': CustomEvent object could not be cloned.
    at dispatchEvent (bridge.js:401:11)
    at channela.js?single:1:5710
    at channela.js?single:1:10195
    at channela.js?single:1:10203

4. chase.com: Sorry, it looks like this part of our site isn't working right now.

Code

N/A

Live example

N/A

Screenshots

No response

Version

Chrome Extension 1.2

Device

Desktop

Browser

Chrome

OS

Windows

[Mugen87]

Is it possible to reproduce the issue without chase.com but with a small test case? The extension also works with jsfiddle so maybe you can share a live example like https://jsfiddle.net/3mrkqyea/?

That would make it much easier to investigate the issue.

[cesmoak]

I looked into this more closely. The issue is that bridge.js is being injected into the page as a <script> tag so all top-level functions defined in bridge.js will be defined on window. So the dispatchEvent function defined in bridge.js is overwriting the native window.dispatchEvent which interferes with any webpage that wants to use window.dispatchEvent. You can verify this is the case by logging window.dispatchEvent to console -- you get the function source from bridge.js instead of ƒ dispatchEvent() { [native code] }

You can see the issue here: https://jsfiddle.net/xe74sado/1/

I suspect the fix is to wrap bridge.js in an anonymous function so that nothing is defined on window. It's late, I can look into that tomorrow.

[mrdoob]

I suspect the fix is to wrap bridge.js in an anonymous function so that nothing is defined on window. It's late, I can look into that tomorrow.

Would be great if you can take a look 🙏