Client-side property modification via cross-origin prototype pollution

Prototype pollution in Mastodon before 3.5.0 allows remote attackers to modify JavaScript object properties through crafted cross-origin messages. The public/embed.js message listener trusted e.data from any origin and used its attacker-controlled id to index the iframes object, so proto selected Object.prototype and its height assignment changed the inherited height property. Exploitation requires a user to visit an attacker-controlled page that sends the message to a page embedding a Mastodon post; the demonstrated effect is limited to overwriting the height property.