4 ms·
Going along with other comments on this thread, if it's the case that you have access to anything that domain has access to, and the webcam is just a flashy way
by tolmasky 7y ago
Going along with other comments on this thread, if it's the case that you have access to anything that domain has access to, and the webcam is just a flashy way of demonstrating this, I would certainly consider it broad access. I would assume this is the case since the problem appears to be in URI parsing, not webcam code.
Of course, if the bug was reported as a webcam issue then I suppose it could be maybe argued that it's fine that they paid for it as such.
- tw04 7y agoI'm not saying I agree or disagree with what Apple gave him, I'm just stating that's why. His proof of concept wasn't god-mode, it was access to the webcam. If he wants the extra $75k, and the exploit allows full access, I'd imagine he'd be incentivized to show full access.
- dodobirdlord 7y agoIt gives access code only to things that the user has given a domain access to, which is not something the attacker can influence.