Leaderboard

Hi, yes, Romania, Bulgaria, Serbia, Albania, Greece - Balkan gyros power ❤️

Veata mea, vezi ca ti-a cazut asta din geaca de vinilin cand mergeai pe strada.

Cam putini coco la cati sunt aia pe planeta. Ai nostrii au fost bombardieri adevarati trag concluzia. Fie si in spirit de trolling, atinge un subiect vechi postarea asta. Ba voi nici sa furati nu mai stiti boss, adunati milioane si va gasesc aia la perchezitii cu Nokia 1310 ca ati facut economie la echipamente, eventual ati tras pe zbarna o saptamana si nu ati realizat ca urmeaza o vizita conjugala. Ba servere gasite, telefoane, sim-uri.. e greu ma sa inchiriati o hala pe o societate comerciala sub paravan L.T.D sa va oferiti timp de respiro? Costa vreo 1000-2000, nu e mult.. se rezolva totul online. Ia un tigan cu 3 clase dar cu buletin, fa-l patron de firma internationala, fii smart plm nu stiu. Cu cele spuse de mai sus, pe cine vrei tu defapt sa iei la misto? Prostul familiei, te anunt ca ai ramas corijent la propria ta materie favorita (boss).

Report description Chrome iOS UXSS Using iOS Shortcuts and Bookmarklets Bug location Where do you want to report your vulnerability? Chrome VRP – Report security issues affecting the Chrome browser. See program rules The problem Please describe the technical details of the vulnerability In Chrome iOS using iOS Shortcuts we can add a new bookmark without any user interaction and confirmation, this bookmark can also be a javascript: URI to become a bookmarklet and get code execution on opened site. Using this behavior and couple other quirks we can silently add a bookmarklet, open a website then showing the bookmarks when tapping on it the bookmarklet will execute on the current opened website without the user knowing. I don't know if there is some protection on this or it's some broken bugs that prevented us to do this straightforward but here is the pseudo code which we are able to perform the attack. Open bookmarks Open blank page and close it immediately Add the bookmarklet Wait 2 seconds and open the user bookmarks Play Chrome dino game Open google.com In the final stage the user sees the bookmarks and in background google.com is opened when tapping on the bookmarklet the code will execute on google.com. POC: Add this Shortcut https://www.icloud.com/shortcuts/cf976fbc13294b00849d5564432b2d0a Run it Tap on where it says Tap Here XSS on google.com Video POC attached. The underlying issue is ability to add a bookmark silently without user knowing or confirmation also no check on the bookmark url which allow an attacker to insert javascript: urls. Impact analysis – Please briefly explain who can exploit the vulnerability, and what they gain when doing so Using this vulnerability an attacker can trick a user to execute arbitrary code on targeted origin by running a shortcut and tapping on a bookmarklet displayed on the screen without knowing anything about it. The cause What version of Chrome have you found the security issue in? Version 137.0.7151.107 Is the security issue related to a crash? No, it is not related to a crash. Choose the type of vulnerability Site Isolation Bypass How would you like to be publicly acknowledged for your report? @RenwaX23 chrome_ios_shortcuts_uxss.mp4 26 MB Download Sursa: https://issues.chromium.org/issues/426631847 Via: https://x.com/RenwaX23/status/1971925046047498432