Other nomination

Attacking the DevTools

David Erceg · Microsoft Browser Vulnerability Research · 21 July 2021

Chromium's DevTools is a privileged page an extension can reach, through an unvalidated remoteBase parameter, a javascript: devtools_page entry, or crafted channel messages that overwrite the stored extension origin. Code running there reads local files, injects scripts into any site or extension, and drives the DevTools Protocol to escape the sandbox.

Record

Researcher

David Erceg

Published by

Microsoft Browser Vulnerability Research

Date

21 July 2021

In the archive

• Nominated for the 2021 Top 10 Web Hacking Techniques

Tags

• sandbox-escape
• privilege-escalation
• browser-extension
• lfi
• iframe
• javascript
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of David Erceg, first published at the original source. Preserved copies are kept so the citation survives its host.