Hacker News Reader

Bust if you read the next section...

"Even if you do not proactively trigger prerendering yourself, it is still possible that another site will instruct Chrome to prerender your site. If your page is being prerendered, it may or may not ever be shown to the user (depending on if the user clicks the link)"

I posted similar concerns in a thread here yesterday which got little response.

View on HN

Oh great - so non-deterministic behaviour adopted by the browser from instructions elsewhere. That's not good. Bring on the exploits!

Good job I've got a low IQ and use IE9 :)

I don't think it's actually any more powerful in that regard than, say, <iframe> tags. If your application lets users perform destructive actions with a GET request, you were already vulnerable.

This is true, but look at the state of most applications out there.

Reply on news.ycombinator.com