Skip to content

Bug: react-dom-client.development.js tries to read $$typeof on iframe object #34840

@jzhan-canva

Description

@jzhan-canva

In ReactFiberPerformanceTrack it tries to deep read the props in DEV mode, props may deeply contains cross-origin frame
which will cause SecurityError: Failed to read a named property '$$typeof' from 'Window': Blocked a frame with origin "http://localhost:8080/" from accessing a cross-origin frame.

React version: 19.2.0 (I believe the change is introduced in #30967)

Steps To Reproduce

there are three factors caused this problem

  1. deep in props there is a reference to host window or document object
  2. google reCAPTCHA is in use. it mounts a iframe and inject the iframe reference to document
Image 3. react 19.2.0 tries to recursively read props object and access `.$$typeof`

The current behavior

Throwing error

The expected behavior

Not to throw error

Metadata

Metadata

Assignees

No one assigned

    Labels

    Status: UnconfirmedA potential issue that we haven't yet confirmed as a bug

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions