Top 10 winner

Cure53 Browser Security Whitepaper

Cure53 Browser Security White Paper

Mario Heiderich, Alex Inführ, Fabian Fäßler, Nikolai Krein, Masato Kinugawa, Tsang-Chi "Filedescriptor" Hong, Dario Weißer and Paula Pustułka · Cure53 · 29 November 2017

A 330-page comparative audit of MSIE11, Edge and Chrome covering memory-safety mitigations, CSP and other security headers, DOM security, extension and plugin models, and UI trust indicators. It documents working attacks such as turning MSIE's XSS Filter into an XSS source, downgrading a framed site's document mode from an attacker page, DOM clobbering, and Cyrillic look-alike domains.

Record

Document

Cure53 Browser Security White Paper

Researcher

Mario Heiderich, Alex Inführ, Fabian Fäßler, Nikolai Krein, Masato Kinugawa, Tsang-Chi "Filedescriptor" Hong, Dario Weißer and Paula Pustułka

Published by

Cure53

Date

29 November 2017

Format

Whitepaper

Topic

Browser

In the archive

• Ranked #9 in the 2016–17 Top 10 Web Hacking Techniques

Tags

• xss
• filter-bypass
• dom-clobbering
• csp
• browser-extension
• same-origin-policy
• iframe
• unicode
• survey
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of Mario Heiderich, Alex Inführ, Fabian Fäßler, Nikolai Krein, Masato Kinugawa, Tsang-Chi "Filedescriptor" Hong, Dario Weißer and Paula Pustułka, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 September 2026.