Collected research

Bonus Safari XXE (only affecting Safari 4 Beta)

Chris Evans · scarybeastsecurity.blogspot.com

A WebKit regression in the Safari 4 Beta reopened XML external entity resolution, letting a crafted XML document read and exfiltrate local files. The regression was noticed through a collision with the Chrome sandbox and fixed before the Safari 4 final release, so no production browser shipped it.

Record

Researcher

Chris Evans

Published by

scarybeastsecurity.blogspot.com

Topic

Injection

In the archive

• Collected in the 2009 research round

Tags

• xxe
• info-leak
• sop-bypass
• same-origin-policy
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Chris Evans, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.