This seems to be explained in better detail by https://bo0om.ru/chrome-and-safari-uxss https://bo0om.ru/chrome-and-safari-uxss. Working via Google Translate, th

This seems to be explained in better detail by https://bo0om.ru/chrome-and-safari-uxss https://bo0om.ru/chrome-and-safari-uxss. Working via Google Translate, the claim seems to be that using MHTML and XSLT allows you to bypass the sandboxing rules and inject JavaScript that bypasses the same-origin policy. The linked blog credits a Chromium patch that led to the discovery of this exploit: https://chromium-review.googlesource.com/c/chromium/src/+/656397 https://chromium-review.googlesource.com/c/chromium/src/+/65...