News for hackers. Stuff that matters.
Re:Stealing private documents through a bug in Google Docs by twiss on Monday December 28, 2020 @11:44AM (#25560627)
Myeah. I was aware that `WindowProxy.location` exists, but not that `WindowProxy.frames` exists. To me, that's the more surprising part - as `window.frames[0].location` should indeed be writable, but I feel like accessing `window.frames[0].frames` is more debatable - even knowing the number of iframes in a page might leak information in certain cases.

There are no comments on this comment yet.