Collected research

Hidden XSS Attacking the Desktop & Mobile Platforms

» The Hidden XSS Attacking the Desktop & Mobile Platforms

Kos · kyleosborn.org

Conference talk arguing that XSS no longer needs a browser tab: injected script inside privileged containers such as browser extensions and mobile app webviews runs with whatever host permissions the container holds. The material covers cross-origin reads and a Google application vulnerability, with released tooling at kos.io/xsspwn.

Record

Document

» The Hidden XSS Attacking the Desktop & Mobile Platforms

Researcher

Kos

Published by

kyleosborn.org

Topic

XSS

In the archive

• Collected in the 2011 research round

Related sources

• XSSPwn
• Kyle Osborne (kos) -- The Hidden XSS -- Attacking the Desktop

Tags

• xss
• browser-extension
• javascript
• sop-bypass
• info-leak
• tooling
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Kos, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 17 August 2026.