{
  "title": "MCP Apps Security Threat Register",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "MCP Apps 2026-01-26 / ext-apps SDK v1.7.5 / MCP core 2026-07-28",
  "sourcePackage": "research/9",
  "integrityNote": "The 93 ordinary archive entries verify. Two self-referential bookkeeping entries have disclosed stale final rows; public corrections do not modify the raw archive.",
  "count": 20,
  "records": [
    {
      "Threat": "Malicious UI bundle",
      "Affected layer": "UI resource/server",
      "Attack path": "Server returns deceptive or hostile HTML/JS",
      "Impact": "Phishing, exfiltration attempts, unsafe tool requests",
      "Primary mitigations": "Sandbox, CSP, trusted publishers, host review, app-specific policy",
      "Sources": "S004 S030 S064",
      "id": "R9-THREAT001",
      "packageSourceIds": [
        "S004",
        "S030",
        "S064"
      ],
      "sourceIds": [
        "S390",
        "S410",
        "S440"
      ]
    },
    {
      "Threat": "Sandbox escape",
      "Affected layer": "Browser/host",
      "Attack path": "Browser or host isolation weakness",
      "Impact": "Parent DOM, cookie or account compromise",
      "Primary mitigations": "Minimal sandbox flags, patching, origin isolation, defense in depth",
      "Sources": "S004 S060",
      "id": "R9-THREAT002",
      "packageSourceIds": [
        "S004",
        "S060"
      ],
      "sourceIds": [
        "S390",
        "S436"
      ]
    },
    {
      "Threat": "postMessage spoofing",
      "Affected layer": "AppBridge/View",
      "Attack path": "Accept messages from wrong source window or origin",
      "Impact": "Unauthorized requests or data injection",
      "Primary mitigations": "Validate source, origin and schema; avoid wildcard trust",
      "Sources": "S061 S064",
      "id": "R9-THREAT003",
      "packageSourceIds": [
        "S061",
        "S064"
      ],
      "sourceIds": [
        "S437",
        "S440"
      ]
    },
    {
      "Threat": "Tool-call abuse",
      "Affected layer": "Host/server",
      "Attack path": "App requests high-authority tools",
      "Impact": "Data modification or external action",
      "Primary mitigations": "Visibility enforcement, allowlists, confirmation, server authorization",
      "Sources": "S004 S037",
      "id": "R9-THREAT004",
      "packageSourceIds": [
        "S004",
        "S037"
      ],
      "sourceIds": [
        "S390",
        "S140"
      ]
    },
    {
      "Threat": "Model-context poisoning",
      "Affected layer": "View/host/model",
      "Attack path": "App sends misleading ui/update-model-context",
      "Impact": "Future model behavior manipulated",
      "Primary mitigations": "Provenance, user visibility, scope by View instance, sanitization",
      "Sources": "S004 S076",
      "id": "R9-THREAT005",
      "packageSourceIds": [
        "S004",
        "S076"
      ],
      "sourceIds": [
        "S390",
        "S452"
      ]
    },
    {
      "Threat": "Prompt injection in tool result",
      "Affected layer": "External data/View/model",
      "Attack path": "Untrusted structuredContent or content",
      "Impact": "Unsafe downstream model/tool behavior",
      "Primary mitigations": "Treat data as untrusted, isolate rendering, host policy",
      "Sources": "S027",
      "id": "R9-THREAT006",
      "packageSourceIds": [
        "S027"
      ],
      "sourceIds": [
        "S123"
      ]
    },
    {
      "Threat": "CSP under-declaration",
      "Affected layer": "App configuration",
      "Attack path": "Required domains omitted",
      "Impact": "Blank or partially working interface",
      "Primary mitigations": "Test against real hosts, validator, diagnostics",
      "Sources": "S010 S072",
      "id": "R9-THREAT007",
      "packageSourceIds": [
        "S010",
        "S072"
      ],
      "sourceIds": [
        "S395",
        "S448"
      ]
    },
    {
      "Threat": "CSP over-declaration",
      "Affected layer": "App configuration",
      "Attack path": "Broad domain allowlists",
      "Impact": "Exfiltration and supply-chain exposure",
      "Primary mitigations": "Least-privilege domains and local bundling",
      "Sources": "S010 S065",
      "id": "R9-THREAT008",
      "packageSourceIds": [
        "S010",
        "S065"
      ],
      "sourceIds": [
        "S395",
        "S441"
      ]
    },
    {
      "Threat": "CORS mismatch",
      "Affected layer": "External API",
      "Attack path": "API does not allow sandbox origin",
      "Impact": "Network request fails despite CSP",
      "Primary mitigations": "Dedicated domain and correct API CORS policy",
      "Sources": "S010 S063",
      "id": "R9-THREAT009",
      "packageSourceIds": [
        "S010",
        "S063"
      ],
      "sourceIds": [
        "S395",
        "S439"
      ]
    },
    {
      "Threat": "Nested-frame abuse",
      "Affected layer": "View/third party",
      "Attack path": "App embeds an untrusted site",
      "Impact": "Clickjacking, tracking, confusing nested consent",
      "Primary mitigations": "Strict frameDomains, host policy, avoid unnecessary frames",
      "Sources": "S080",
      "id": "R9-THREAT010",
      "packageSourceIds": [
        "S080"
      ],
      "sourceIds": [
        "S456"
      ]
    },
    {
      "Threat": "UI spoofing of host controls",
      "Affected layer": "View UX",
      "Attack path": "App imitates host confirmation or account UI",
      "Impact": "Phishing and mistaken consent",
      "Primary mitigations": "Host chrome, visual boundaries, design review, clear provenance",
      "Sources": "S004 S006",
      "id": "R9-THREAT011",
      "packageSourceIds": [
        "S004",
        "S006"
      ],
      "sourceIds": [
        "S390",
        "S136"
      ]
    },
    {
      "Threat": "App-only tool exposure to model",
      "Affected layer": "Host implementation",
      "Attack path": "Host ignores visibility metadata",
      "Impact": "Model invokes implementation-only operations",
      "Primary mitigations": "Conformance tests and tool filtering",
      "Sources": "S004 S070",
      "id": "R9-THREAT012",
      "packageSourceIds": [
        "S004",
        "S070"
      ],
      "sourceIds": [
        "S390",
        "S446"
      ]
    },
    {
      "Threat": "Model-only tool exposure to app",
      "Affected layer": "Host implementation",
      "Attack path": "Host proxies app tools/call without visibility check",
      "Impact": "Privilege expansion",
      "Primary mitigations": "Reject unauthorized app calls and log provenance",
      "Sources": "S004 S075",
      "id": "R9-THREAT013",
      "packageSourceIds": [
        "S004",
        "S075"
      ],
      "sourceIds": [
        "S390",
        "S451"
      ]
    },
    {
      "Threat": "Cross-instance context collision",
      "Affected layer": "Host state",
      "Attack path": "Same ui:// resource rendered multiple times shares one context slot",
      "Impact": "Wrong instance influences next model turn",
      "Primary mitigations": "Instance IDs and scoped state",
      "Sources": "S076",
      "id": "R9-THREAT014",
      "packageSourceIds": [
        "S076"
      ],
      "sourceIds": [
        "S452"
      ]
    },
    {
      "Threat": "Resource update/supply-chain compromise",
      "Affected layer": "Package/CDN",
      "Attack path": "App bundle or dependency changes after review",
      "Impact": "Previously approved UI becomes hostile",
      "Primary mitigations": "Pin hashes/versions, review changes, bundle dependencies",
      "Sources": "S017 S037",
      "id": "R9-THREAT015",
      "packageSourceIds": [
        "S017",
        "S037"
      ],
      "sourceIds": [
        "S402",
        "S140"
      ]
    },
    {
      "Threat": "Sensitive logs",
      "Affected layer": "Telemetry",
      "Attack path": "App sends secrets through notifications/message",
      "Impact": "Credential or data leakage",
      "Primary mitigations": "Redaction and logging policy",
      "Sources": "S004",
      "id": "R9-THREAT016",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Threat": "Unbounded resizing",
      "Affected layer": "Host layout",
      "Attack path": "Repeated size-changed notifications",
      "Impact": "Denial of UI, layout instability",
      "Primary mitigations": "Host limits and throttling",
      "Sources": "S004",
      "id": "R9-THREAT017",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Threat": "External link abuse",
      "Affected layer": "View/host",
      "Attack path": "ui/open-link to deceptive or dangerous URL",
      "Impact": "Phishing or unsafe navigation",
      "Primary mitigations": "Scheme/domain validation and user notice",
      "Sources": "S004",
      "id": "R9-THREAT018",
      "packageSourceIds": [
        "S004"
      ],
      "sourceIds": [
        "S390"
      ]
    },
    {
      "Threat": "Permission overreach",
      "Affected layer": "Browser permissions",
      "Attack path": "App requests camera/mic/location unnecessarily",
      "Impact": "Privacy loss",
      "Primary mitigations": "Deny by default, explicit user permission, feature detection",
      "Sources": "S004 S066",
      "id": "R9-THREAT019",
      "packageSourceIds": [
        "S004",
        "S066"
      ],
      "sourceIds": [
        "S390",
        "S442"
      ]
    },
    {
      "Threat": "Host divergence",
      "Affected layer": "Ecosystem",
      "Attack path": "Different hosts implement different subsets or interpretations",
      "Impact": "Broken apps and inconsistent security",
      "Primary mitigations": "Public tests, canonical validator, per-host testing",
      "Sources": "S069 S070",
      "id": "R9-THREAT020",
      "packageSourceIds": [
        "S069",
        "S070"
      ],
      "sourceIds": [
        "S445",
        "S446"
      ]
    }
  ]
}