Other nomination

My hacking adventures with Safari reader mode

Nikhil Mittal · Payatu · 27 August 2020

Safari Reader mode strips scripts but renders an SVG anchor pointing at a javascript: URI, giving script execution, and a title/child-frame quirk lets a cross-origin child frame read the top frame's content, breaking the same-origin policy.

Record

Researcher

Nikhil Mittal

Published by

Payatu

Date

27 August 2020

In the archive

• Nominated for the 2020 Top 10 Web Hacking Techniques

Related sources

• Talk recording

Tags

• sop-bypass
• xss
• sanitizer-bypass
• same-origin-policy
• iframe
• javascript
• ios
• csp
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Nikhil Mittal, first published at the original source. Preserved copies are kept so the citation survives its host.