My bank rcuonline.org has a broken widget

[engineermdr]

My local bank updated their website a several months ago and the widget used to display account information has stopped working and just shows "Error! There was an error loading the widget". The following is with my latest try with Palemoon version 33.6.1.

This only occurs after I log into the website, and I can't share that information, so I know this could be difficult. I'd be happy to provide any additional information needed.

Code: Select all

Synchronous XMLHttpRequest on the main thread is deprecated because of its detrimental effects to the end user’s experience. For more help http://xhr.spec.whatwg.org/ 
Spending.js:1:3274
Failed to execute ‘postMessage’ on ‘DOMWindow’: The target origin provided (‘https://widgets.moneydesktop.com’) does not match the recipient window’s origin (‘https://www.rcuonline.org’).

Timestamp: 04/03/25 11:17:56
Error: Failed to execute ‘postMessage’ on ‘DOMWindow’: The target origin provided (‘https://widgets.moneydesktop.com’) does not match the recipient window’s origin (‘https://www.rcuonline.org’).
Source File: https://widgets.moneydesktop.com/md/mini_budgets/N2Y2MWRiMWFjYmYxMGNiMzM1MDI0MmI2MWQxMWI1NzVlZDE2Zjg3MjQyNGE3N2UyZGIyZjZkYzg1OTlkZjUwOGFhNzFmYWU0OTdhYTNmY2YwZTYwOWFmNzllMTQ2ODJjNDU5OTAyNDVhZjQyMTVkZWY3ZDllOWUyMGU5ZTA1ODk5YzE2ZGU1ODJmZGU4YzIwNjlkMGI4ZDAxNzAyMWI5OHxVU1ItMGVmOWRmZmEtZmM0MS02MzJiLTY4MTUtMjk2MTNhMmNjOTA1
Line: 0

Thank you.

[andyprough]

Looks like this is a security issue for Pale Moon, which may be why it refuses to load the widget:

Code: Select all

The target origin provided (‘https://widgets.moneydesktop.com’) does not match the recipient window’s origin (‘https://www.rcuonline.org’)

[Moonchild]

Yeah I'm not sure why mainstream browsers started to accept this and how this is not a big red flag for them. Using postMessage cross-origin is bad.

[engineermdr]

How bad of a security issue is this? This is my bank account after all and now I'm wondering if my accounts are at risk.