This attack would be pretty easy to mitigate. Why does WoW allow you to run scripts in your chat window? Who needs that functionality?
Yes, don't run untrusted code as a user, but also developers should be practicing defense in depth[0]. This isn't like pasting something into a web browser's dev console or a Bash prompt, WoW has the ability to just outright turn this behavior off.
Look at something like the Signal source code, they flat out turn off webviews entirely[1]. So an entire class of phishing attacks just vanishes, regardless of what they're doing to block XSS or malicious links.
WoW should do the same thing - your chat window should not have access to its host environment, if it even needs the ability to run scripts in the first place.
Yes, don't run untrusted code as a user, but also developers should be practicing defense in depth[0]. This isn't like pasting something into a web browser's dev console or a Bash prompt, WoW has the ability to just outright turn this behavior off.
Look at something like the Signal source code, they flat out turn off webviews entirely[1]. So an entire class of phishing attacks just vanishes, regardless of what they're doing to block XSS or malicious links.
WoW should do the same thing - your chat window should not have access to its host environment, if it even needs the ability to run scripts in the first place.
[0]: https://en.wikipedia.org/wiki/Defense_in_depth_%28computing%...
[1]: https://github.com/signalapp/Signal-Desktop/blob/development...