Collected research

Attacking the DevTools

Guest Blog Post - Attacking the DevTools

David Erceg · Microsoft Browser Vulnerability Research · 21 July 2021

Chromium's DevTools is a privileged page an extension can reach, through an unvalidated remoteBase parameter, a javascript: devtools_page entry, or crafted channel messages that overwrite the stored extension origin. Code running there reads local files, injects scripts into any site or extension, and drives the DevTools Protocol to escape the sandbox.

Record

Document

Guest Blog Post - Attacking the DevTools

Researcher

David Erceg

Published by

Microsoft Browser Vulnerability Research

Date

21 July 2021

Topic

Other

In the archive

• Collected in the 2021 research round

Tags

• sandbox-escape
• privilege-escalation
• browser-extension
• lfi
• iframe
• javascript
• bug-bounty
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of David Erceg, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.