9 ms·
How is this any different in principle than $.get("page", function(result){document.body = result;}); ? If the attacker can run the javascript you mentioned, t
by gcr 11y ago
How is this any different in principle than $.get("page", function(result){document.body = result;}); ?
If the attacker can run the javascript you mentioned, they've already run.
- biggerfisch 11y agoThe "benefit" is that it causes a "trusted" tab to change, not a new one that a user might expect to be tainted. If I open a link from HN (for example), read it, and close the tab, I'd expect to be back at HN. If the link changed my `window.opener` url to a fake-HN, I could do some action that asks for a password or some similar data. It's more likely to succeed since the user already trusts the existing window/tab/site.