Vulnerability Research
5 posts in this category.
The Page Never Had Permission. The Extension Did.
A web page cannot call most extension APIs, but it can influence a content script that can message a privileged service worker. This research method proves when that chain becomes a confused deputy and how to reduce it to explicit, testable capabilities.
The Package Was Signed. The Update Was Still a Security Decision.
A browser extension update preserves publisher identity while it can change code, permissions, remote configuration, and privileged behavior across an entire installed fleet. This research method turns that release path into an evidence-backed authorization boundary.
The Extension Was Sandboxed. The Native Host Was Not.
Browser Native Messaging crosses from an untrusted page through an extension into an operating-system process. This research method maps every sender, message, host manifest, parser, native operation, and resulting effect before calling the bridge secure.
Three False Alarms in a Privileged Helper Sweep
Seven third-party helpers run as root on this Mac. I checked whether each one authenticates the process talking to it, was wrong three times in a row, and found nothing. The interesting part is why each cheap method failed.
The Patch Is a Disclosure. The Bug Is in the Delta.
Patch diffing turns the vendor's fix into a map to the vulnerability. The workflow is not 'find the bug' — it is 'find the change, read it backwards, and hunt the same class everywhere else.'