Hacker News Reader

Comment by Capira | Hacker News Reader

Simplified POC:

  javascript://%0aprompt()

You need the full a://a.a/%0a to match the URL pattern, but that's the jist of it.

I thought so too but a quick test showed that the code from Capira does indeed work

Where did you test it? In a VM?

If you have a Mac that's on OS X 10.11.3-, then you shouldn't be running unpatched systems.

Ah okay, we have a few other vulns (that have been patched) in various other messaging apps, some required the full pattern others not.