Top 10 winner

Breaking Google Gears' Cross-Origin Communication Model

Yair Amit · IBM Application Security Insider · 8 December 2008

Google Gears' worker loader ignored the Content-Type of the files it loaded, so any user-uploadable file, even one served as innocent.jpg, could be loaded as a cross-origin Gears worker running in the hosting site's origin. Worker code contains no angle brackets, so upload filters rarely catch it; from there it reads authenticated pages via Gears HttpRequest and messages the results back.

Record

Researcher

Yair Amit

Published by

IBM Application Security Insider

Date

8 December 2008

Topic

Other

In the archive

• Ranked #2 in the 2008 Top 10 Web Hacking Techniques

Tags

• sop-bypass
• same-origin-policy
• content-type
• mime
• file-upload
• browser-extension
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Yair Amit, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 September 2026.