Preliminary research

FCSC 2026 writeups: Firefox `execCommand` ICU-vs-JS case-folding differential, Gunicorn `HEAd` smuggling, libmagic polyglots

FCSC 2026 Writeups. Tags:Writeup - Writeup - FCSC2026

kevin_mizu · mizu.re

AI-collected research leads through 22 September 2026, including targeted additions between broader sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Five CTF web writeups, each a parser disagreement. JavaScript's toLowerCase expands U+0130 to two code points so an execCommand blocklist misses it, while Firefox's u_tolower maps it to plain i and runs insertHTML. Angular ignores matrix params after ';' that Apache counts as real directories, reopening a traversal. DOMPurify lowercases an invalid element name to an allowed tag that JSDOM serialises unescaped, and gunicorn strips a trailing 0x85 byte from Transfer-Encoding where Apache keeps it.

Record

Document

FCSC 2026 Writeups. Tags:Writeup - Writeup - FCSC2026

Researcher

kevin_mizu

Published by

mizu.re

Topic

Browser

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• parser-differential
• request-smuggling
• unicode
• dom-clobbering
• mutation-xss
• xss
• path-traversal
• sanitizer-bypass
• postmessage
• mime
• owasp-a01-2021
• owasp-a03-2021
• owasp-a05-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of kevin_mizu, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 16 August 2026.