Other nomination

Flash Internet Explorer security model bug

Guy A · Guy A · 10 September 2008

Loading a bare .swf in IE makes the browser build a wrapper page via res://mshtml.dll/objectembed_neutral.js, with allowscriptaccess defaulting to samedomain, so the SWF can script that page through ExternalInterface. IE blocks access to document — but a single F5 lifts the block permanently, and the SWF can trigger the reload itself with window.location.reload().

Record

Researcher

Guy A

Published by

Guy A

Date

10 September 2008

In the archive

• Nominated for the 2008 Top 10 Web Hacking Techniques

Tags

• flash
• sop-bypass
• same-origin-policy
• javascript
• dom
• filter-bypass
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Guy A, first published at the original source. Preserved copies are kept so the citation survives its host.