Researcher - Gareth Heyes

Summary: Gareth Heyes is a PortSwigger researcher known for breaking the AngularJS sandbox and building XSS vectors, and he authored PortSwigger's XSS Cheat Sheet and the book JavaScript for Hackers. His listed papers include DOM based AngularJS sandbox escapes (11 May 2017), Blind CSS Exfiltration (05 December 2023), Splitting the email atom (07 August 2024), and CSS: the bomb inside your inbox (06 August 2026).
Why it matters: The researcher behind the XSS Cheat Sheet and the AngularJS sandbox escapes now works on CSS-based attacks, including exfiltrating unknown web pages and a technique framed as a bomb inside an inbox - a shift toward the styling layer most teams never treat as an attack surface.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026