Other nomination

Facebook Messenger Bug Hunting - A Bug's E2E Lifecycle

Luke McLaren and Farah Hawa · docs.google.com · 9 December 2024

Three Meta Messenger bugs: a URL check that treats any domain merely starting with the brand name as genuine, so phishing links get official branding in encrypted chats; an effect icon URL with a bad path that crashes group calls; and negative offsets or lengths in mentions that crash the recipient's encrypted chat.

Record

Researcher

Luke McLaren and Farah Hawa

Published by

docs.google.com

Date

9 December 2024

Format

Recording

In the archive

• Nominated for the 2024 Top 10 Web Hacking Techniques

Related sources

• Slides

Tags

• url-parsing
• filter-bypass
• dos
• webrtc
• fuzzing
• android
• bug-bounty
• case-study
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Luke McLaren and Farah Hawa, first published at the original source. Preserved copies are kept so the citation survives its host.