Other nomination

Get pwned by scanning QR Code

Nikhil Mittal · Payatu · 10 December 2019

Firefox for iOS executed javascript URIs supplied by its built-in QR code scanner, so scanning a crafted code ran script in the context of the page the user was already viewing and could read its contents and cookies. It also worked in reader mode, on local files and internal pages, and ignored the site's content security policy. Opera Mini for iOS was affected too.

Record

Researcher

Nikhil Mittal

Published by

Payatu

Date

10 December 2019

In the archive

• Nominated for the 2019 Top 10 Web Hacking Techniques

Tags

• xss
• url-parsing
• csp
• ios
• sop-bypass
• cve
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Nikhil Mittal, first published at the original source. Preserved copies are kept so the citation survives its host.