PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

MetaMask Snaps: playing in the sand

osec.io | vulnerability | #vulnerability | #javascript | #browser-extension | #sandbox | #metamask | #snaps
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec digs into MetaMask Snaps' sandbox — isolated iframe, LavaMoat, SES — and breaks down a property spoofing vulnerability it reported in the Snaps sandboxing layer.
Published
Collected

Related coverage

blog · osec.io
Supply chain attacks: a new era
OtterSec unpacks Lavamoat's Web3 supply-chain defenses — policy files, NPM anti-hijacking, scuttling — and the sneaky bypasses it reported, showing how hard JS ecosystems are to lock down.
blog · projectzero.google
Trashing the Flow of Data
In this blog post I want to present crbug.com/944062, a vulnerability in Chrome’s JavaScript compiler TurboFan that was discovered independently by Samuel (saelo@) via fuzzing with fuzzilli, and by myself via manual code auditing. The bug was found in beta and was fixed before it made it into the stable release of Chrome, but I think it’s interesting for a few reasons and decided to write about it. The issue was in TurboFan’s handling of the Array.indexOf builtin and at first it looked like an info leak at best, so it was not clear that you can turn this into an arbitrary write primitive. Besides that, it’s an instance of a common bug pattern in JIT compilers: the code was making assumptions at compile time without inserting the corresponding runtime checks for these assumptions.
vulnerability · blog.quarkslab.com
Snapshotting our way to CVE-2026-9539
This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.
vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
vulnerability · yeswehack.com
How to find IDOR, stored XSS, information disclosure vulnerabilities – from our #1 hunters for these CWEs
Learn how to find IDOR, stored XSS and information disclosure vulnerabilities with practical tips and techniques from YesWeHack’s top-ranked bug hunters.
Back