Summary
Phishing detection in src/utils/security/phishingProtection.ts runs synchronously per navigation. Calling PhishingProtection.detectPhishing on every render or every navigation event without debouncing/rate-limit burns CPU and could be abused via DOM-style events.
Affected area
src/utils/security/phishingProtection.ts
Steps to reproduce / impact
Excessive clones / iframes force N domain checks per second.
Expected behaviour
Memoise per window.location.origin for the lifetime of the page, and rate-limit background reporting.
Acceptance criteria
Summary
Phishing detection in
src/utils/security/phishingProtection.tsruns synchronously per navigation. CallingPhishingProtection.detectPhishingon every render or every navigation event without debouncing/rate-limit burns CPU and could be abused via DOM-style events.Affected area
src/utils/security/phishingProtection.tsSteps to reproduce / impact
Excessive clones / iframes force N domain checks per second.
Expected behaviour
Memoise per
window.location.originfor the lifetime of the page, and rate-limit background reporting.Acceptance criteria