// archive
Tag: Browser Security
BUG BOUNTY WRITEUPS
Tabnabbing in Microsoft Edge: When the Browser Ignores rel=”noopener”
// TL;DR Reverse tabnabbing has a well-known fix: a site adds rel=”noopener” to its outbound target=”_blank” links, which stops the opened page from controlling the original…
BUG BOUNTY WRITEUPS
Content Spoofing in Microsoft Edge
// TL;DR After an earlier address-bar spoofing bug I reported in Edge was fixed as CVE-2018-8383, I found a related issue in the same area: Edge…
BUG BOUNTY WRITEUPS
Address Bar Spoofing in Microsoft Edge (CVE-2018-8383)
// TL;DR Microsoft Edge decided what to show in the address bar before the page it was navigating to had actually loaded. By redirecting to a…
SOCIAL ENGINEERING
Tabnabbing in Action: A Facebook Example
// TL;DR Tabnabbing (tabnapping) is a sneaky phishing technique that takes advantage of browser tabs you’ve left open and stopped paying attention to. Here’s a concrete,…