3 ms·

> The exploit was simply injected on every news article page through an iframe Was the "src" of the iframe 3rd-party to the web site? I want to know whether me

by gorhill 11y ago

> The exploit was simply injected on every news article page through an iframe Was the "src" of the iframe 3rd-party to the web site? I want to know whether merely blocking 3rd-party iframes would also have prevented the exploit from working even if javascript is not blocked.

fukusa 11y ago
Yes it was so it would have prevented the exploit from loading.
- Brybry 11y ago
  Do you know if NoScript with javascript disabled but iframes allowed and pdfjs enabled would have stopped it? A vulnerability test would be really nice but I understand why it doesn't exist yet.
  - fukusa 11y ago
    It would have stopped it. Js has to be active for the exploit script to run.