WebKit: UXSS via CachedFrameBase::restore

This is similar to the case https://bugs.chromium.org/p/project-zero/issues/detail?id=1151. But this time, javascript handlers may be fired in FrameLoader::open. void FrameLoader::openCachedFrameBase& cachedFrame ... cleardocument, true, true, cachedFrame.isMainFrame; Click anywhere... function...

Apple WebKit CachedFrameBase::restore cross-site scripting vulnerability

Apple WebKit is the open source web browser engine. A cross-site scripting vulnerability in Apple WebKit CachedFrameBase::restore allows an attacker to construct a malicious web page that can be tricked into parsing and executing arbitrary code...

WebKit - CachedFrameBase::restore Universal Cross-Site Scripting

WebKit - CachedFrameBase::restore Universal Cross-Site Scripting Click anywhere... function createURLdata, type = 'text/html' return URL.createObjectURLnew Blobdata, type: type; function navigatew, url let a = w.document.createElement'a'; a.href = url; a.click; window.onclick = = window.w =...

WebKit CachedFrameBase::restore Universal Cross Site Scripting

WebKit: UXSS via CachedFrameBase::restore This is similar to the case https://bugs.chromium.org/p/project-zero/issues/detail?id=1151. But this time, javascript handlers may be fired in FrameLoader::open. void FrameLoader::openCachedFrameBase& cachedFrame ... cleardocument, true, true,...

WebKit - enqueuePageshowEvent and enqueuePopstateEvent Universal Cross-Site Scripting Exploit

Exploit for multiple platform in category dos / poc view-frame.page; frame.tree.appendChildchildFrame-view-frame; childFrame-open; enqueuePageshowEventPageshowEventPersisted; HistoryItem historyItem = frame.loader.history.currentItem; if historyItem && historyItem-stateObject...

WebKit - enqueuePageshowEvent enqueuePopstateEvent Universal Cross-Site Scripting

WebKit - enqueuePageshowEvent enqueuePopstateEvent Universal Cross-Site Scripting view-frame.page; frame.tree.appendChildchildFrame-view-frame; childFrame-open; enqueuePageshowEventPageshowEventPersisted; HistoryItem historyItem = frame.loader.history.currentItem; if historyItem &&...