Security

The story of Chromium security bug 48733 , with guest Cris Neckar, part I It has been a long time now, but the story of Chromium security bu...

HSTS , standing for HTTP Strict Transport Security, is a relatively new standard that aims to bolster the strength of HTTPS connections. Hop...

How do you execute code in a turing complete language via the <img> tag? Why, by combining an XSL transform into an SVG image of cour...

I find this bug interesting, because at first it looks like a relatively minor cross-origin leak. But with a bit of investigation, it has ma...

A few weeks back, I published a demo that uses a serious Internet Explorer cross-origin violation to permit a malicious web page to force th...

Now that this paper is officially public, the full story of CSS-based cross-origin theft can come out. (As an aside I'd like to note th...

Firefox just released version 3.6.7 of their excellent browser, and it fixes this: http://www.mozilla.org/security/announce/2010/mfsa2010-46...