@securitymb@infosec.exchange

@[email protected]

@SecurityMB

Improving the world’s security at Google. Opinions are mine.

Zurich, Switzerland Tham gia Eylül 2014
284 Đang theo dõi11K Người theo dõi
Tweet ghim
@securitymb@infosec.exchange
@[email protected]@SecurityMB·
Finally, my research is published. It has everything you might wish for in browser security: universal XSS, mutation XSS, CSS data exfiltration, and others. Check this out! In a few days, we'll also release a 30-minute presentation about this topic.
Securitum@securitum_com

We are publishing the research of Copy&Paste issues in browsers by @SecurityMB. Over $30k in bounties for bugs in Chromium, Firefox, Safari, Google Docs, Gmail, TinyMCE, CKEditor, and others. Includes also 0-day in Froala. research.securitum.com/the-curious-ca…

English
9
113
405
0
@securitymb@infosec.exchange
@[email protected]@SecurityMB·
That must be the worst captcha I’ve ever seen.
@securitymb@infosec.exchange tweet media
English
0
0
0
801
@securitymb@infosec.exchange
@[email protected]@SecurityMB·
@gridogram I forgot to play gridogram yesterday. Is there an option to play yesterday's puzzle?
English
1
0
0
439
@[email protected] đã retweet
Ark
Ark@arkark_·
Cross-Site ETag Length Leak blog.arkark.dev/2025/12/26/eta… I just posted the author writeup for impossible-leak in SECCON CTF 14 Quals. As far as I know, this is a new XS-Leak technique! The ETag header can become a side channel :)
English
4
99
359
40.6K
@securitymb@infosec.exchange
@[email protected]@SecurityMB·
Has there been some email leak from @Canva? Just got a spam message for an email used only for Canva.
@securitymb@infosec.exchange tweet media
English
2
0
2
1.9K
@[email protected] đã retweet
Rebane
Rebane@rebane2001·
my new blogpost is out!! this one talks about a new web vulnerability class i discovered that allows for complex interactive cross-origin attacks and data exfiltration and i've already used it to get a google docs bounty ^^ have fun <3 lyra.horse/blog/2025/12/s…
English
20
78
438
39.4K
🕊
🕊@sephr·
what's a good use case for this outside of anti-fraud?
English
2
0
0
105
@[email protected] đã retweet
terjanq
terjanq@terjanq·
We published a blogpost about SafeContentFrame - a library for rendering untrusted content inside an iframe. The library is a big party of what I've been up to in the few last years! Check out the blog and take a slice of my birthday cake 🎂! bughunters.google.com/blog/671552987…
terjanq tweet media
English
6
52
197
17.2K
@[email protected] đã retweet
Google VRP (Google Bug Hunters)
Google VRP (Google Bug Hunters)@GoogleVRP·
Rendering untrusted web content is fraught with security risks 🕸️ 🛡️. Read how SafeContentFrame, a new TypeScript library, offers a robust solution for isolating web content and protecting against threats like XSS and side-channel attacks. goo.gle/3K5DRQJ
English
3
18
102
8.3K
@securitymb@infosec.exchange
@[email protected]@SecurityMB·
@RenwaX23 @kinugawamasato @Google In this case I fixed the bug myself, which anyone can do for Chromium 😀 there’s even a Patch bonus #patch-bonus" target="_blank" rel="nofollow noopener">bughunters.google.com/about/rules/ch…
English
1
0
2
314
Masato Kinugawa
Masato Kinugawa@kinugawamasato·
community.brave.com/t/bug-brave-un… yikes, Brave's HTML serialization seems really broken <div id=x><span x="aaa&gt;&bbb"></div> <script> x.innerHTML=x.innerHTML; alert(x.innerHTML)// <span x="" aaa="">&amp;bbb"&gt;</span> </script>
English
9
28
160
22.6K
@securitymb@infosec.exchange
@[email protected]@SecurityMB·
@matmul Not sure if it's widely used in the industry but Google's "Go style decisions" explicitly require such comments to start with the function name. #doc-comments" target="_blank" rel="nofollow noopener">google.github.io/styleguide/go/…
English
1
0
2
219
suraj
suraj@matmul·
ai is a true ocd helper
suraj tweet media
Français
1
1
5
2.6K
@securitymb@infosec.exchange
@[email protected]@SecurityMB·
@kinugawamasato My assumption is that they're doing some sort of match-and-replace on the HTML. The reason why I think so is that you get different results for `<div title="a>&quot;"></div>` and `<div title="a>&quot;">` (missing end tag). This shouldn't affect start tag parsing.
English
0
0
4
441
Masato Kinugawa
Masato Kinugawa@kinugawamasato·
@SecurityMB true. This only seems to happen when parsing is triggered via JS APIs. doc=new DOMParser().parseFromString(`<span x="asdqwe>&amp;">z</span>`,'text/html'); alert(doc.body.innerHTML)//<span x="" asdqwe="">&amp;"&gt;z</span>
English
1
0
5
1.4K

Khám phá

@gridogram @canva @sephr @RenwaX23 @kinugawamasato @Google @google @elonmusk