Browser security
Extension isolation, page messaging, native hosts, release provenance, update pipelines, runtime configuration, and the exact point where web-controlled intent or new code becomes a privileged effect.
Start here, then go deeper.
Start at the web principal, preserve sender context through the extension, and prove exactly which native effect the operating system process can create.
- 01Native MessagingThe Extension Was Sandboxed. The Native Host Was Not.18 min ↗
Browser Native Messaging crosses from an untrusted page through an extension into an operating-system process. This research method maps every sender, message, host manifest, parser, native operation, and resulting effect before calling the bridge secure.
- 02Extension messagingThe Page Never Had Permission. The Extension Did.21 min ↗
A web page cannot call most extension APIs, but it can influence a content script that can message a privileged service worker. This research method proves when that chain becomes a confused deputy and how to reduce it to explicit, testable capabilities.
- 03Update supply chainThe Package Was Signed. The Update Was Still a Security Decision.12 min ↗
A browser extension update preserves publisher identity while it can change code, permissions, remote configuration, and privileged behavior across an entire installed fleet. This research method turns that release path into an evidence-backed authorization boundary.
Every matching record.
Methods and named-vulnerability research remain visually and editorially separate.
Field notes 3
The Page Never Had Permission. The Extension Did.
A web page cannot call most extension APIs, but it can influence a content script that can message a privileged service worker. This research method proves when that chain becomes a confused deputy and how to reduce it to explicit, testable capabilities.
21 min read ↗Vulnerability Research · Aug 31, 2026The Package Was Signed. The Update Was Still a Security Decision.
A browser extension update preserves publisher identity while it can change code, permissions, remote configuration, and privileged behavior across an entire installed fleet. This research method turns that release path into an evidence-backed authorization boundary.
12 min read ↗Vulnerability Research · Aug 31, 2026The Extension Was Sandboxed. The Native Host Was Not.
Browser Native Messaging crosses from an untrusted page through an extension into an operating-system process. This research method maps every sender, message, host manifest, parser, native operation, and resulting effect before calling the bridge secure.
18 min read ↗