4 ms·Simplified POC: javascript://%0aprompt()by Capira 11y agoSimplified POC: javascript://%0aprompt()moloch 11y agoYou need the full a://a.a/%0a to match the URL pattern, but that's the jist of it.lukashed 11y agoI thought so too but a quick test showed that the code from Capira does indeed workzuck9 11y agoWhere did you test it? In a VM? If you have a Mac that's on OS X 10.11.3-, then you shouldn't be running unpatched systems.moloch 11y agoAh okay, we have a few other vulns (that have been patched) in various other messaging apps, some required the full pattern others not.