Other nomination

Hidden XSS Attacking the Desktop & Mobile Platforms

Kos

Conference talk arguing that XSS no longer needs a browser tab: injected script inside privileged containers such as browser extensions and mobile app webviews runs with whatever host permissions the container holds. The material covers cross-origin reads and a Google application vulnerability, with released tooling at kos.io/xsspwn.

Record

Researcher

Kos

In the archive

• Nominated for the 2011 Top 10 Web Hacking Techniques

Related sources

• Companion code
• Talk recording

Tags

• xss
• browser-extension
• javascript
• sop-bypass
• info-leak
• tooling
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Kos, first published at the original source. Preserved copies are kept so the citation survives its host.