Java Script Security
Summary: PortSwigger's BApp Store lists a third-party Burp extension called JavaScript Security, version 1.1, last updated 10 September 2019, that adds passive scanner checks by loading received HTML into a headless Chromium instance via Selenium. The extension adds a JavaScript Security tab for configuration and can load indicators of compromise as JSON files, with output and errors shown on the Extender/Extensions tab under "JavaScript Security -- SRI and Threat Intel."
What's compelling: The extension is third-party code that PortSwigger explicitly does not warrant for quality or usefulness, and its last update was 10 September 2019 - so a security team relying on it is running an unmaintained component inside the tool that scans its own web applications.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026