flâneur

Guest Blog Post - Attacking the DevTools | Microsoft Browser Vulnerability Research

microsoftedge.github.io · 3,281 words · saved by 1 readers

In this post, we’ve invited David Erceg, one of the participants in the Edge bug bounty program, to talk about interesting bugs he found in Edge. By sharing this information, we hope more security researchers are motivated to work with us to improve the security of Edge and Chromium as a whole. Within Chromium and its derivatives, the DevTools is an interesting attack surface. That’s because the DevTools itself is fairly highly privileged, especially if it’s attached to a page as part of a debugging session. Therefore, bugs within the DevTools can allow a malicious extension to escalate its privileges. That’s because an extension may have the ability to load DevTools URLs and once an extension can do that, it can potentially take advantage of any bugs that are present. The post here will examine how an extension could, in previous versions of Chrome/Edge, run code within the context of the DevTools and how the ability to do that could allow the extension to run code outside of the brow

Guest Blog Post - Attacking the DevTools Contents Guest Blog Post - Attacking the DevTools In this post, we’ve invited David Erceg , one of the participants in the Edge bug bounty program , to talk about interesting bugs he found in Edge. By sharing this information, we hope more security researchers are motivated to work with us to improve the security of Edge and Chromium as a whole. Introduction Within Chromium and its derivatives, the DevTools is an interesting attack surface. That’s because the DevTools itself is fairly highly privileged, especially if it’s attached to a page as part of a

saved by

related reading