Other nomination
CVE-2023-5480: Chrome new XSS Vector
Chrome's Payment Request API fetched a payment method manifest directly from a URL and just-in-time installed the service worker it named. Any site serving user-uploaded files under their own MIME type could be made to register an attacker's service worker on its own origin, which then answers every request with attacker HTML, giving persistent XSS.
Record
- Researcher
- Vsevolod Kokorin
- Date
- Format
- Advisory
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Vsevolod Kokorin, first published at the original source. Preserved copies are kept so the citation survives its host.