Cross-Origin Popup Takeover in Trezor Connect popup

A flaw in the Trezor Connect v9 popup allowed it to process cross-window messages in core mode without properly verifying that they came from a trusted source. As a result, a malicious web page could interact with the popup's message handler directly rather than through the normal trusted flow. This could be used to read non-sensitive device information without user interaction, and to request read-only operations like address or public-key retrieval behind a permission dialog that misrepresented the requesting origin on the trusted connect.trezor.io domain. Sensitive actions were not affected: permission dialogs could not be approved automatically, and signing and other destructive operations still required physical confirmation on the device. The fix ensures the popup only accepts messages from trusted origins and returns responses to a specific destination rather than broadcasting them.