XSS Attacks

272 Chapter 6 9 XSS Exploited

The code snippet presented here demonstrates the vulnerability found by Pilgrim. The

script is simple but very dangerous, as it is obvious that attackers can steal any sensitive file

from the victim's file system.

Although this particular vulnerability was fixed, it is important that we take the valuable

lesson it gave us which is: although a lot of effort is put to secure the browser, insecurely

coded extensions can lead to the user's system being compromised. Extension developers

don't pay that much attention to the security implications of their work. ...