I'm an intern at a big company and my education is in Security Risk Analysis but I somehow got put on a software development team and am basically relegated to research. I'm surrounded by software dev's who I can't really ask for clarification on security questions so here I am.
I'm looking into using refresh tokens with PKCE on browser based-apps (which seems like a really bad idea). Anyway, one of the things I found for doing this securely was Token Binding, which Google decided not to implement citing in part a low frequency of token interception attacks, like XSS and the token leaking to third party scripts running in the browser.
However, Symantec, in their ISTR 24 document, noted the supply chain and Living Off the Land attacks increased by 78% last year. I'm trying to figure out if this is going to pose a future threat to Single Sign On and Single Page Applications due tho their vulnerability to malicious scripts. If the attacks mentioned above are LOtL attacks, then that could indicate an emergent threat, yes?