2021年3月31日水曜日

A Hack to render untrusted content in an isolated process

›
Sometimes, Web apps needs to render untrusted content in their websites, where the content can execute script. And most of them are implemen...
2020年3月3日火曜日

投機的なWebの修復

›
先日 Mozaic.fm でCross Origin Info Leaksについて話しました。 ep63 Cross Origin Info Leaks 雑談編 （こちらはプラバシーや新しいEdgeなどセキュリティとは関係ない雑談です） ここではMozaicで話した事...
2019年9月18日水曜日

Nonce-based CSP + Service Worker = CSP bypass?

›
Service Worker is a great technology that allows you to develop web app's offline experience and increase performance of your website. ...
1 件のコメント:
2019年7月2日火曜日

Intro to Chrome's (g)old features

›
This post is about following 2 features and how to (ab)use them. PNaCl Chromium-Intercept Those 2 features are old enough that they m...
2018年9月10日月曜日

What Permission Delegation changes in Web Security

›
There is a plan to ship Permission Delegation in Chrome 71 . So I will try to summarize what would change in Web Security . Reasons of ...
2018年9月8日土曜日

Abusing just-in-time payment app in Chrome

›
While I was reading about Payment Handler API , I came across one sentence. Chrome also supports a non-standard feature we call just-in-ti...
2018年2月9日金曜日

Abusing sandbox domain to steal Chrome 0days

›
Today, I'll write about sandbox domain. Sandbox domain is special domain meant to host untrusted (user uploaded) files. This make su...