> For example: did you know that if you click on a link from coredump.cx > to microsoft.com and it opens in a new window, then a second or two > later, that coredump.cx in the background can change the URL of the > microsoft.com window, and point it to evil.com? Heck, coredump.cx can > even wait until you navigate further down the microsoft.com website - > and detect that event programmatically. That behavior is enshrined > within the current design of the same-origin policy, and browser > vendors seem hesitant to touch it.
Here's a tiny PoC: http://lcamtuf.coredump.cx/switch/ /mz _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
