BugTraq
seamless bait-and-switch Dec 08 2011 09:30AM
Michal Zalewski (lcamtuf coredump cx)
Hello world,

Another whimsical browser proof-of-concept:

http://lcamtuf.coredump.cx/switch/

It seems that relatively few people realize that holding a JavaScript
handle to another window (either because we opened it, or because the
window was at some point displaying our content) allows the attacker
to tamper with the location and history objects at will, largely
bypassing the usual SOP controls. With some minimal effort and the
help of data: / javascript: URLs or precached pages, this can be
leveraged to replace content in a manner that will likely escape even
fairly attentive users.

/mz

PS. Obligatory plug: http://lcamtuf.coredump.cx/tangled/

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus