CVE-2026-43735

CVE-2026-43735 WebKit divulgazione di informazioni cross-origin. Safari = 26.5.2: PATCHED NavigateEvent.sourceElement is null Principio Quando la pagina padre utilizza per attivare la navigazione di frammento di un iframe cross-origin, l'iframe riceve NavigateEvent.sourceElement che è l'elemento...

LavaDome

LavaDome 🌋️ Uma nova ferramentaLavaMoat para E ncapsulamento s eguro de nós do DOM ⚠️ EXPERIMENTAL WIP - USE POR SUA CONTA E RISCO saiba mais Demo Tente quebrar oLavaDome - visite o aplicativo de demonstração, abra o console e faça tudo ao seu alcance para roubar o segredo de dentro da instância...

webrtc-ips

STUN IP Address requests for WebRTC Demo: https://diafygi.github.io/webrtc-ips/ What this does Firefox and Chrome have implemented WebRTC that allow requests to STUN servers be made that will return the local and public IP addresses for the user. These request results are available to javascript,...

CVE-2017-17692

CVE-2017-17692 Titolo Exploit: SOP Bypass Data: 06 settembre 2017 Link Software: https://play.google.com/store/apps/details?id=com.sec.android.app.sbrowser&hl=en Autore Exploit: Dhiraj Mishra Contatto: http://twitter.com/mishradhiraj Sito Web: http://datarift.blogspot.in/ Categoria: Browser Video...

whonow

Server DNS Whonow Un server DNS malevolo per eseguire attacchi DNS Rebinding al volo. whonow ti consente di specificare dinamicamente le risposte DNS e le regole di rebinding usando le richieste di dominio stesse. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first...

dref

DNS-Rebinding-Exploitation-Framework Dieses Projekt wird nicht mehr gewartet. dref erledigt die schweren Aufgaben für das DNS-Rebinding. Der folgende Ausschnitt aus einem seiner integrierten Payloads zeigt, wie das Framework verwendet wird, um ein lokales Subnetz von einem gehackten Browser aus z...

CVE-2026-12295-UXXS-in-my-wasm

CVE-2026-12295 — dati srcdoc su un URI non about:srcdoc UXSS in Firefox Proof of concept: un processo di contenuto compromesso forgia un caricamento PDocumentChannel il cui nsDocShellLoadState trasporta SrcdocData insieme a un URI arbitrario. Le build vulnerabili servono l'HTML dell'attaccante co...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — bypass della Same-Origin Policy tramite intercettazione cross-port CVE-2026-20643...

CVE-2026-43700

CVE-2026-43700 WebKit WebGPU importExternalTexture vazamento de informações entre origens. Safari vermelho/verde/azul/branco Versão corrigida = 26.5.2: PATCHED importExternalTexture blocked: SecurityError Princípio GPUDevice.importExternalTexturesource: HTMLVideoElement importa o vídeo como uma...

singularity

Singularity of Origin Recent updates: NEW 2025-11-25 : Chrome release 142 added Local Network Access LNA, which prevents DNS rebinding attack techniques implemented in Singularity. Singularity of Origin's LNA-from-Non-Secure-Contexts branch implements support for Trial for Local Network Access fr...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and...

nosurf-cve-2025-46721

CVE-2025-46721: CSRF a causa di controlli same-origin non funzionanti in justinas/nosurf Cosa è successo? Sono vulnerabile? PoC Patch Ringraziamenti Cosa è successo? Tutte le versioni di nosurf precedenti alla 1.2.0 non applicavano i controlli same-origin per le richieste in entrata. Ciò è accadu...

vuln-chain-lab

File Upload Bypass + Stored XSS PoC Labor Eine bewusst verwundbare Webanwendung, die zeigt, wie ein File-Upload-Bypass mit Stored-XSS verkettet wird, um Backdoor-Admin-Konten zu erstellen, selbst wenn CSP-, CORS- und CSRF-Schutzmaßnahmen vorhanden sind. Ausführlicher Blogbeitrag: KurtiseBear Blog...

PHP-CGI-INTERNAL-RCE

PHP-CGI-INTERNAL-RCE Questa PoC dimostra come un attaccante può concatenare di Orange Tsai CVE-2024-4577 con il DNS rebinding per ottenere l'esecuzione remota di codice sull'infrastruttura di rete interna direttamente tramite il browser della vittima. Bypassando la Same-Origin Policy SOP e...

Exploit for Improper Isolation or Compartmentalization in Mozilla Firefox

CVE-2026-12295 — srcdoc data on a non-about:srcdoc URI Firefo...

firefox: thunderbird: Same-origin policy bypass in the Graphics: ImageLib component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Graphics: ImageLib component...

firefox: thunderbird: Same-origin policy bypass in the Audio/Video: Playback component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Audio/Video: Playback component...

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Medium...

Astra Linux - Vulnerability in webkit2gtk

This issue was addressed through improved state management. This issue has been fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4, iPadOS 16.4, tvOS 16.4, and watchOS 9.4. Processing maliciously crafted web content may bypass the Same-Origin Policy...