CSS Cache Exploit Needs To Be Addressed #1431
BugHunter1000
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
https://thehackernews.com/2021/03/new-browser-attack-allows-tracking.html
Basically, it looks like a site can put an arbitrarily large number of characters into a CSS pattern, thereby hammering your cache, and can then exfiltrate data even with javashit turned off.
This absolutely must be addressed.
I might suggest limiting the number of characters in the CSS to be in the hundreds or thousands, rather than millions which is apparently where this exploit takes place. I am only just now reading this so feel free to correct any mistakes.
Best wishes.
Beta Was this translation helpful? Give feedback.
All reactions