Escaping Java Script sandboxes with parsing issues
Summary: PortSwigger researcher Gareth Heyes fuzzed all characters from 0x00 to 0x10ffff and found 721,520 inconsistently handled Unicode escapes in Safari's JavaScriptCore engine, which parses a Unicode escape after 'typeof' as both an operator and a variable. The post ties this to Michał Bentkowski's earlier finding that Caja, Google's JavaScript/HTML sandbox, was vulnerable to XSS because its parser handled comments differently than the browser.
Key Takeaway: A sandbox only holds if its parser reads code exactly the way the browser does, and here the browser and the sandbox disagreed on the same input - the gap Bentkowski used to get XSS through Caja.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026