News for hackers. Stuff that matters.

A comment on Stealing private documents through a bug in Google Docs. Parent comment

Re:Stealing private documents through a bug in Google Docs by ape4 on Monday December 28, 2020 @09:37AM (#25559470)
I agree this, seems wrong. Does it work in all browsers?
[ Parent | on HN ]
Re:Stealing private documents through a bug in Google Docs by twiss on Monday December 28, 2020 @10:02AM (#25559667)
It seems there's a typo in the quote, but the following indeed works in both Chrome and Firefox:

    window.frames[0].frames[2].location = "https://example.com";
Even if `window.frames[0]` is cross-origin.
[ Parent | on HN ]
Re:Stealing private documents through a bug in Google Docs by jandem on Monday December 28, 2020 @01:48PM (#25561919)
This behavior is defined in the HTML spec, here:

https://html.spec.whatwg.org/multipage/browsers.html#crossor...

[ Parent | on HN ]