Collected research

Apple's Safari 4 also fixes cross-domain XML theft

Chris Evans · scarybeastsecurity.blogspot.com

Safari 4 fixed a cross-domain XML theft in which one origin could read another origin's XML: XHTML, AJAX RPC responses and authenticated feeds. The demo steals the XML of a logged-in Gmail user's inbox. The post argues that each new browser feature referencing content by URI is another chance for a missing cross-domain check.

Record

Researcher

Chris Evans

Published by

scarybeastsecurity.blogspot.com

Topic

Browser

In the archive

• Collected in the 2009 research round

Related sources

• Safari cross-domain Gmail disclosure
• PacSec presentation

Tags

• same-origin-policy
• sop-bypass
• info-leak
• xsleak
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of Chris Evans, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.