5 ms·
Don't troll. CSS cannot run arbitrary code on your device.
by yuvadam 12y ago
Don't troll. CSS cannot run arbitrary code on your device.
- deleted 12y ago[deleted]
- domas 12y agoActually there are some CSS vulnerabilities that works without JavaScript like <div> overlay affecting phishing attacks: http://i8jesus.com/?p=10 http://i8jesus.com/?p=10 Via: http://stackoverflow.com/questions/718611/css-injection-whats-the-worst-that-can-happen http://stackoverflow.com/questions/718611/css-injection-what...
- VMG 12y agoNeither can JS, as it is sandboxed. The interpretation and application of CSS directives is not Turing complete, but often enough to leak information from your browser.
- csandreasen 12y ago> Neither can JS, as it is sandboxed. Not true. It's definitely possible to escape the sandbox. Some examples: https://github.com/rapid7/metasploit-framework/tree/master/modules/payloads/singles/firefox https://github.com/rapid7/metasploit-framework/tree/master/m... http://www.mozilla.org/security/announce/2013/mfsa2013-12.html http://www.mozilla.org/security/announce/2013/mfsa2013-12.ht... http://www.iss.net/security_center/reference/vuln/googlechrome-javascript-bo.htm http://www.iss.net/security_center/reference/vuln/googlechro... https://bugzilla.mozilla.org/show_bug.cgi?id=805121 https://bugzilla.mozilla.org/show_bug.cgi?id=805121 https://www.usenix.org/legacy/event/woot08/tech/full_papers/daniel/daniel.pdf https://www.usenix.org/legacy/event/woot08/tech/full_papers/...