PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Side Effects: When Continuous Development Introduces Security Threats

theori.io | research | #browser-security | #xss | #http2 | #url-parsing | #rapid-reset | #xs-search
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Five security threats accidentally introduced by new features: hidden-element XSS via contentvisibilityautostatechange, HTTP/2 rapid reset, Apple’s FaceTime bug, XS-Search and URL parsing bypasses.
Published
Collected

Related coverage

research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
CSS:the bomb inside your inbox
PortSwigger breaks webmail CSS sanitizers to cross trust boundaries, exfiltrate tokens, control AI browsers by email and steal passwords, with attacks spanning Yahoo, Fastmail, ProtonMail and Gmail.
research · portswigger.net
Top 10 web hacking techniques of 2025
PortSwigger's 19th annual Top 10 Web Hacking Techniques, drawn from 63 community nominations and ranked by an expert panel including James Kettle — the must-read web security research of 2025.
research · portswigger.net
Gotta cache 'em all: bending the rules of web cache exploitation
Doyhenard's research exploits URL parser discrepancies and RFC ambiguities between CDNs and origins — delimiters, normalization, static extensions — achieving arbitrary cache poisoning and deception.
research · portswigger.net
HTTP/2: The Sequel is Always Worse
HTTP/2-exclusive desync attacks: implementation flaws and RFC imperfections enable cache poisoning, credential theft and request tunnelling against ALB, WAFs and CDNs, netting multiple max bounties.
research · portswigger.net
"The entire internet is broken": ethical hacking expert John Hammond meets James Kettle
John Hammond and James Kettle discuss the HTTP/1.1 Must Die research in a video, covering new desync attack classes, CDN compromises, and the case for moving upstream connections to HTTP/2.
Back