News for hackers. Stuff that matters.

A comment on Stealing private documents through a bug in Google Docs. Parent comment

Re:Stealing private documents through a bug in Google Docs by twiss on Monday December 28, 2020 @10:02AM (#25559667)
It seems there's a typo in the quote, but the following indeed works in both Chrome and Firefox:

    window.frames[0].frames[2].location = "https://example.com";
Even if `window.frames[0]` is cross-origin.
[ Parent | on HN ]

There are no comments on this comment yet.