/
attack_type:xss × victim_sectors:technology × limpar

Resultados

2 casos · pág. 1/1

hacktron.ai · high

Hacktron discloses one-click UXSS in Perplexity Comet via XSS on a perplexity.ai subdomain and externally_connectable abuse

Hacktron researchers disclosed a one-click universal XSS (UXSS) in Perplexity Comet, a Chromium-based AI browser with the Comet Assistant agent extension. The extension's manifest trusts the wildcard https://.perplexity.ai/ in externallyconnectable, so a single XSS on any perplexity.ai subdomain can reach privileged extension message hand…

technology
hacktron.ai · high

Hacktron chains forums.openai.com postMessage XSS with exposed Mojo IPC in OpenAI ChatGPT Atlas to steal OAuth tokens

Researchers at Hacktron disclosed a vulnerability chain in OpenAI's ChatGPT Atlas Chromium-based AI browser that lets an attacker monitor all open tabs and capture OAuth authorization codes for any site, effectively breaking the same-origin policy. Atlas exposes Mojo IPC bindings to all .chatgpt.com and .openai.com origins, so a single XS…

technology