On 2/15/07, Michal Zalewski <[EMAIL PROTECTED]> wrote: > Actually, there are several odd problems related to location updates and > location.hostname specifically, including one scenario that apparently > makes the script run with document.location in about: namespace. > > I did not research them any further, so I can't say if they're > exploitable - but you can see a demo here, feel free to poke around: > > http://lcamtuf.coredump.cx/fftests.html >
I tried these and all worked as advertised except the last one which shot the browser to 100% CPU but was recoverable when I closed the tab after a few seconds. -sb > Cheers, > /mz > http://lcamtuf.coredump.cx/ > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
