fix: hide internal events from page

src/injected/util/index.js

@@ -14,7 +14,7 @@ export * from '#/common/consts';
 
 export const fireBridgeEvent = (eventId, msg, cloneInto) => {
   const detail = cloneInto ? cloneInto(msg, document) : msg;
-  const evtMain = new CustomEventSafe(eventId, { detail });
+  const evtMain = new CustomEventSafe(eventId, { __proto__: null, detail });
   window::fire(evtMain);
 };
 
@@ -37,7 +37,7 @@ export const bindEvents = (srcId, destId, bridge, cloneInto) => {
   });
   bridge.post = (cmd, data, { dataKey } = bridge, node) => {
     // Constructing the event now so we don't send anything if it throws on invalid `node`
-    const evtNode = node && new MouseEventSafe(destId, { relatedTarget: node });
+    const evtNode = node && new MouseEventSafe(destId, { __proto__: null, relatedTarget: node });
     fireBridgeEvent(destId, { cmd, data, dataKey, node: !!evtNode }, cloneInto);
     if (evtNode) window::fire(evtNode);
   };