Abusing Chrome's XSS auditor to steal tokens
Summary: PortSwigger researcher Gareth Heyes showed that Chrome's XSS auditor in block mode, which strips page content when it detects an attack, could be used as an oracle: by injecting fake XSS vectors and reading the cross-domain contentWindow.length of an iframe, an attacker could detect whether the auditor fired. He later extracted a 32-character hash from a form action one character at a time by padding the filter, working around the auditor's tendency to ignore zeros, and the technique was patched in the latest version of Chrome.
Key Takeaway: A browser defense designed to strip malicious content became a side channel that leaked a 32-character token character by character, and the same detection worked through new windows even when X-Frame-Options or CSP blocked framing.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026