HN

Comments (28)

• darkamaul
  Orange is a legend and this chain is extremely impressive here.No memory corruptions, no heap shenanigans, just pure logic bugs, almost made easy to understand for the reader.As a bonus, they also posted a reverse chain: popping Edge from calc [0].[0] https://www.youtube.com/watch?v=Bh1zglq4mLE
• adzm
  > with a simple fetch(...) with credentials included, you can easily grab any Microsoft Edge user’s email from any websiteWow, this is disturbing on its own
• Menu

  its-summertime
  I always felt bad about the whole site/browser cross integration that chrome and edge and others do. Now I feel really really really bad about it. Can almost see the marketing team's emails about what features to add, and the developers unwantingly writing the code not expecting such things to open so many holes
• Menu

  antonly
  It's very refreshing to read such clearly written and concise technical reports.
• deburo
  I guess that explains the questions I had when I was mysteriously logged into Edge. I checked whether Chrome does something similar, and it can, but the setting "Sign in to Chrome when you sign in to other Google services" was set to "Don't sign in", so I'm not sure whether this is the default or not.
• tveita
  > So even if you’ve never created a User Profile in the browser, just visiting www.microsoft.com is enough for Edge to create one and sign you in automatically.This is disgusting behaviour, RCE chain or not.
• anon
  undefined
• Vaushite
  This is very awesome and cool.
• Menu

  zhiyan
  human craft is becoming rare these days
• sharpshadow
  The popup nightmare never stops.
• breakingcups
  This is amazing work.
• berofeev
  Excellent write up
• Menu

  cyclopeanutopia
  Stopped at> I won’t go into too much detail in this post, because I think in this era, you can just ask your agents to fill in the details :)