galwm

4 ms·

1.
by galwm 18d ago
More to come! Thanks! BRowser AGent JACKing
2.
With 1 Extension: $20K in Bounties from Anthropic, Perplexity, Google, Microsoft(forever.security)
10 points by galwm 18d ago|9 comments
3.
The Rest of the Iceberg: What We Miss About Browser Extensions Attack Surface(twitter.com)
2 points by galwm 3mo ago|0 comments
4.
Chrome extensions with 10M+ devices are actively vulnerable to UXSS and UXSG(rebora.io)
9 points by galwm 4mo ago|1 comments
5.
Is client side security dead – or a crucial part of the future?(weizmangal.com)
4 points by galwm 3y ago|1 comments
6.
by galwm 3y ago
Client side security is a niche tech field that seems to be unneeded for the most part. As someone who's very passionate about it, that's something that's hard for me to accept. After Shubham Shah addressed this topic in his
7.
XSS CVE in Snyk Advisor allowed making malicious packages look popular and legit(twitter.com)
2 points by galwm 3y ago|0 comments
8.
by galwm 4y ago
This is great! Shouldn't there be a link in the app to the Github source code repo? I wasn't able to find it
9.
Snow JavaScript: A new browser JavaScript security tool for iframes protection(github.com)
2 points by galwm 4y ago|1 comments
10.
by galwm 4y ago
Snow JS gets a callback and passes to it every new iframe/realm that is born in the web app, thus preventing attackers from maliciously abusing iframes to attack the app
11.
by galwm 5y ago
Abusing the Chromium Devtools Scope Pane can allow execution of Javascript by the devtools while the main thread is paused by the debugger! I used this trick to create a very powerful anti debugging technique library that tracks the flow of
12.
JavaScript Anti Debugging (Abusing Chromium Devtools Scope Pane)(medium.com)
2 points by galwm 5y ago|1 comments