4 ms·
This has been known for at least a decade or two already. And a much worse attack exists: you copy e.g. shell code from the page, and instead of what you see,
by itvision 3y ago
This has been known for at least a decade or two already.
And a much worse attack exists: you copy e.g. shell code from the page, and instead of what you see, you paste something evil in your terminal.
- sshine 3y agoThis is another exploit that relies on ‘display: none’.
- elric 3y agoI don't see how the copy issue is worse. It relies on an explicit user action: selecting text in a browser window, and then copy/pasting that into a terminal. This requires three intentional steps. Pages stealing your current middle-mouse-paste selection, however, only requires selecting text in another place, and it seems like the only way to defend against this is by not selecting text. Which, at least for me, is not really feasible.