Abusing jQuery for CSS powered timing attacks
Summary: PortSwigger researcher Gareth Heyes found that Red Hat's access.redhat.com passed location.hash to the jQuery $ function inside a hashchange event, allowing a timing attack that used jQuery's :has and :contains selectors to infer a logged-in user's full name from the page. Heyes modified Burp's dynamic analysis to scan for jQuery selectors run inside hashchange events, and the vulnerability has since been fixed.
What you should know: The flaw turned what jQuery had already patched into unexploitable XSS back into a way to read a logged-in user's full name, using nothing more than repeated hash changes and measured selector performance.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026