---
id: 5536
title: "JSON hijacking for the modern web"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/json-hijacking-for-the-modern-web"
published_at: "2022-08-16T09:33:00Z"
tags: ["web-security", "proxy", "json-hijacking", "edge", "cross-origin", "utf-16be"]
phying_url: "https://phying.com/item/5536"
lang: en
---

# JSON hijacking for the modern web

## Summary

Gareth Heyes revives cross-domain JSON hijacking with JS proxies that capture undefined variables, plus an Edge bypass via Object.setPrototypeOf. A UTF-16BE charset trick makes JSON arrays stealable.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-08-16T09:33:00Z
- **Original:** https://portswigger.net/research/json-hijacking-for-the-modern-web
- **Phying News:** https://phying.com/item/5536