New answers tagged

0

To directly answer your question: no, but read on. The question is slightly unclear in that it asks about "data on websites opened". If by data, you mean "can a tab see the contents of another tab", then no. The attack would come from JavaScript, a language whose security model is reference-based. Even if the rules on existing mechanisms are ignored ...


0

The origin constraint is between the active script (script in that specific browser tab) and the script that gets called. It doesn't matter how you open other tabs, they are not part of the exchange and have no impact on it, except for possible opened sessions. Active sessions will not affect the same origin constraint either.


2

The --disable-web-security option applies to the entire Chrome application, not to a particular window. If you enable this option when starting Chrome, then any site you visit can access data from sites you visited earlier. For example if I was looking at my Online Banking account, and then closed that tab and navigated to a malicious site, that malicious ...


1

You are confusing CORS with SOP. CORS enables Cross Origin Resource Sharing(unless authorized by the receiver), while SOP Ensures the Data is being accessed by the Same origin that created it. So by CORS you can't access other Tab's/Frame's data, unless you can execute JavaScript there. More on CORS & SOP. There is no way you can cross SOP, unless you'...


2

The risk isn't that a script such as http://attacker.com/omg.php runs on your domain, it is that a user manages to break out of the <div style='background-image: url("http://example.com/image.jpg")'></div> context where the URL is written to the page. Note the code has been corrected from your question (single quotes used for HTML attribute ...



Top 50 recent answers are included