Google deprecates XSS Auditor for Chrome

guest · Jul 16, 2019

Google deprecates XSS Auditor for Chrome
The age of browser XSS filters is over
July 16, 2019
https://portswigger.net/daily-swig/google-deprecates-xss-auditor-for-chrome

Google is removing XSS Auditor for Chrome after a series of vulnerabilities have plagued the hotly-contested security feature. [...] Chromium devs announced last night.
Bypassing the auditor
XSS Auditor was also plagued by a number of bypass exploits. In fact, the ability to bypass was so common that it was considered a “functional bug” by the Chromium team, and not a security issue.
World renowned web security researcher Mario Heiderich has bypassed XSS Auditor in the past, and the vector still works today.

Researcher terjanq detailed in April how he was able to abuse the filter mode by bypassing the DOM validator for a CTF challenge using the well-known technique of abusing the filter to disable scripts.
The technique of abusing the filter to disable scripts once again highlighted shortcomings in XSS Auditor, reigniting calls to remove the feature altogether.
Click to expand...

Log in or Sign up

Google deprecates XSS Auditor for Chrome

guest Guest

Log in or Sign up

Google deprecates XSS Auditor for Chrome

guest Guest

Useful Searches