4 ms·

I don't quite follow. The author says that by entering the URL "http://avlidienbrunn.se/@twitter.com/@hehe.php" http://avlidienbrunn.se/@twitter.com/@hehe.php",

I don't quite follow. The author says that by entering the URL "http://avlidienbrunn.se/@twitter.com/@hehe.php" http://avlidienbrunn.se/@twitter.com/@hehe.php", the extension is fooled into autofilling as if the browser was on twitter.com. What's the difference with simply going to "http://twitter.com" http://twitter.com"? This looks more like a bug than a vulnerability, what am I missing?

K0nserv 10y ago
An attacker could fool the extension to autofill a form on a domain they control with credentials from another domain and send the credentials to their server.
rietta 10y ago
A bug that tricks the secure password management tool into revealing your Twitter password to a website that is not Twitter! That's a pretty major security vulnerability due to a bug in URL parsing.
- kmiroslav 10y ago
  But the information is not sent to the server, it's simply pasted in the text field.
  - tronje 10y ago
    Yes, but some JavaScript can detect that the text field has been filled, and then send the information back to the attacker's server. An (innocent) example of this is when you type something into Google's search field, and you already see suggestions, even though you haven't clicked anywhere or hit Enter yet.
  - deleted 10y ago
    [deleted]
  - deleted 10y ago
    [deleted]