Tag
Orange Tsai of DEVCORE Research Team presents a fully handmade, logic-only Microsoft Edge full chain built for Pwn2Own Berlin 2026, chaining 5 bugs and 2 Windows features into a sandbox escape without memory corruption, earning $175,000 and a Pwnie Epic Achievement award.
The author recounts a sophisticated phishing attack that spoofed Google login, Apple passkey prompts, and their Bitwarden-fork password manager—ultimately adding a new passkey to their compromised Google account—and argues passkeys and browser extension detection APIs make phishing worse.
A web tool that demonstrates what information web pages can collect about users without permission and what additional data can be obtained with explicit consent, highlighting browser capabilities and privacy risks.
The author describes their personal method for secure and private web browsing using restricted Firefox with extensions like uBlock Origin and containerization to block ads, trackers, and improve security.
AliExpress employs hidden WebAudio fingerprinting for browser security, which unintentionally breaks Bluetooth multipoint functionality by keeping audio contexts active, as uncovered through technical analysis.
This academic paper empirically investigates whether Google's transition from Manifest V2 to V3 in Chrome reduces ad blocker effectiveness, finding no statistically significant degradation and even slight improvements in anti-tracking for MV3 ad blockers.
A security engineer at a B2B tech company seeks advice on preventing data exfiltration from employee-built AI tools ('vibe-coded' agents) using session-level DLP without forcing an enterprise browser, discussing options like browser extensions and agentless SSE solutions such as Red Access.