To be honest, I'm not so sure about that. Two attack surfaces I can think of off the top of my head where that could be leveraged are dynamic plugin loading, a

To be honest, I'm not so sure about that. Two attack surfaces I can think of off the top of my head where that could be leveraged are dynamic plugin loading, a-la old school ActiveX, and LD_LIBRARY_PATH attacks on ld.so based platforms. One might say that both of these vectors are obsolete, but anytime you have a dynamic coding situation, that is one more term which is added to the equation of how one can interact with a system, regardless of its legitimacy. I'm reminded of this example: http://archive09.linux.com/feature/42031 http://archive09.linux.com/feature/42031 Or perhaps another example involving attacks which use many vectors, a dual action bytecode verifier & x86 shellcode attack: http://www.securityfocus.com/blogs/746 http://www.securityfocus.com/blogs/746 If you can convince any piece of code to do the unintended, that can be a constructive attack vector. Sure, we can harken back to the old days when code only did simple parsing and stayed away from data parsed in multiple contexts. I doubt that will be a sellable market proposition in the age of the Internet of Advertising, however!