Collected research

My hacking adventures with Safari reader mode

Nikhil Mittal · Payatu · 27 August 2020

Safari Reader mode strips scripts but renders an SVG anchor pointing at a javascript: URI, giving script execution, and a title/child-frame quirk lets a cross-origin child frame read the top frame's content, breaking the same-origin policy.

Record

Researcher

Nikhil Mittal

Published by

Payatu

Date

27 August 2020

Topic

Browser

In the archive

• Collected in the 2020 research round

Related sources

• POC2020 talk - My Hacking Adventures With Safari Reader Mode

Tags

• sop-bypass
• xss
• sanitizer-bypass
• same-origin-policy
• iframe
• javascript
• ios
• csp
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Nikhil Mittal, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 16 August 2026.