Collected research

HaXmas: The True Meaning(s) of Metasploit

@todb and Tod Beardsley · Rapid7 Blog · 25 December 2017

Samsung Internet Browser let JavaScript that opened a new tab rewrite that tab's contents after the destination site had loaded, breaking the same-origin policy. An attacker whose page the victim visits can inject arbitrary script into any domain, which the write-up traces from bug report to a shipped Metasploit module.

Record

Researcher

@todb and Tod Beardsley

Published by

Rapid7 Blog

Date

25 December 2017

Topic

Other

In the archive

• Collected in the 2016–17 research round

Related sources

• Samsung browser SOP bypass module
• Samsung browser SOP bypass initial report

Tags

• sop-bypass
• same-origin-policy
• android
• javascript
• tooling
• case-study
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of @todb and Tod Beardsley, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.