Skip to content
Using Hackability to uncover a Chrome infoleak
portswigger.net | research | #browser-security | #chrome | #same-origin-policy | #information-leak | #hackability | #oauth-tokens
Summary
Using his Hackability Inspector, Gareth Heyes found a Chrome infoleak: setting a cross-domain iframe to about:blank exposed baseURI, leaking full URLs and enabling OAuth token theft across subdomains.
- Published
- Collected