Office-Add-Ins

Outlook web add-ins are a weird security boundary. They look like normal web apps because they are built with HTML, CSS, and JavaScript. But they run inside Outlook, interact with mailbox data, and often get trusted more than they should. That mix is exactly why XSS in Outlook web add-ins deserves special attention. If you already know how to prevent XSS in a regular web app, you are not done. Outlook add-ins add their own constraints, APIs, hosting model, and trust assumptions. Some of those help. Some make things worse. ...

Excel web add-ins are just web apps wearing an Office badge. That sounds obvious, but teams forget it all the time. I’ve seen this play out the same way more than once: a team builds a task pane add-in, treats workbook data like “internal content,” renders it into the DOM, and accidentally creates a clean XSS path inside Excel. The UI looks harmless. The payload comes from a spreadsheet cell, a custom function result, or a document setting. Then somebody pastes attacker-controlled content into a workbook, shares it, and the add-in executes script in the task pane. ...