News for hackers. Stuff that matters.

A comment on Serious Chrome zero-day. Parent comment

Re:Serious Chrome zero-day by hartator on Wednesday March 06, 2019 @05:52PM (#19323798)
The thing seems to be linked to FileReader. Maybe just linking to an external image is enough.
[ Parent | on HN ]
Re:Serious Chrome zero-day by idlewan on Wednesday March 06, 2019 @08:00PM (#19324683)
FileReader is not related to an image tag loading its image, it's a javascript API: https://developer.mozilla.org/en-US/docs/Web/API/FileReader

So attacker would still need to have some javascript loaded somewhere for it to work. If electron app displays user-generated content, XSS can help run a javascript payload, however.

[ Parent | on HN ]