Collected research

Same Origin Bypassing Using Image Dimensions

Arshan Dabirsiaghi · i8jesus.com

A covert channel built entirely from image tags, for a future browser sandbox that blocks dynamically inserted script, link and iframe elements. The evil server encodes payload bytes as the height and width of returned images; the client reads two characters per request via Image(), needing only image pre-loading, which no sandbox is likely to forbid.

Record

Researcher

Arshan Dabirsiaghi

Published by

i8jesus.com

Topic

Browser

In the archive

• Collected in the 2008 research round

Related sources

• Same-origin bypass demonstration

Tags

• sop-bypass
• same-origin-policy
• side-channel
• info-leak
• javascript
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Arshan Dabirsiaghi, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.