🔥The 9th Round of Easy Loan, Earn $40 Reward is in progress❗️ ⏰ Promotion Period: January 15th - Feburary 15th, 2025 👉 Register now and check more details at gate.io/campaigns/358

This has been a very exciting and fun project to work on!

Did anyone find a real world XSS using sonarsource.com/blog/encoding-… ? I'm wondering how many sites still does not set charset.

Chrome Extension context isolation bypass. (reward: $10000) crbug.com/371011220

❌ Eliminating almost all exploitable web vulnerabilities? This blog post covers how the Google security team implemented a high-assurance web framework to achieve this goal for its services, and what this framework's most important characteristics are. bughunters.google.com/blog/664431627…

I think everyone had enough fun with it that we can now remove this feature 😊

If you are interested in AI Security, come work with me, Sal ꙮ, and many other amazing engineers in Agent Security team! We have open roles for security engineers and software engineers 🙂 google.com/about/careers/… google.com/about/careers/… google.com/about/careers/…

And here is a role in NYC, in case you prefer US-based roles. google.com/about/careers/…

Fixed in < 10 days 😉

🔥 A new (more difficult) era for mXSS will come soon! If nothing breaks, Chromium will start escaping "<" and ">" in attributes starting with M138. See chromestatus.com/feature/626498… for details.

lol, this works on Firefox: <object data=# codebase=javascript:alert(document.domain)//> OR <embed src=# codebase=javascript:alert(document.domain)//>

「よくわかんないけど… なんもわからん!」をモットーに、Shibuya.XSSでXSSと全く関係ない話をします！

Some fun with a web browser without involving memory corruption.

Here's my blog post about escaping `<>` in attributes and why it makes mXSS harder to exploit!

It's just physically impossible for humans to find ~14 bugs per day for ~80 days.

#shibuyaxss 楽しかった！ 会場を貸して頂いたサイボウズ様、いつも有難う御座います！ そして忙しい中開催してくれたYosuke HASEGAWAさんにも感謝。 スライドは来週には公開できると思うので、フォローしてお待ち下さいw