2 ms·
Apologies if I read this wrong, but it appears they actually found another way to exploit the _existing_ vuln, not a new one. Just checking my understanding.
by exabrial 5y ago
Apologies if I read this wrong, but it appears they actually found another way to exploit the _existing_ vuln, not a new one.
Just checking my understanding.
- heax 5y agoThat is how I understood it also. The new part of their discovery is that visiting a malicious website can run the attack on servers in the private network via a JavaScript application and websockets. That means even applications which are not exposed to the internet can be attacked.
- totony 5y agostill confused why browsers allow private network access from non-private domains