Hacker News Reader

What are the attack vectors for a web browser js environment to do malicious things? All browser code is sandboxed via origin controls, and process isolation. It can’t even open an iframe and read the contents of that iframe.

View on HN

It's a fine place to run code trusted by the server (or code trusted by the client within the scope of the app).

But for code not trusted by either, it's bad -- user data in the app can be compromised/exfiltrated.

Hence for third-party plugins for a web app, the built-in JS runtime doesn't have sufficient trust management capability.

The attack vectors are either some type of credential or account compromise. Generally, these attacks fall under the cross-site scripting (XSS) umbrella. The browser exposes certain things to the JS context based on the origin. E.g. if you log in to facebook.com, facebook.com might set an authentication cookie that can be accessed in the JS context. Additionally, all outbound requests to facebook.com will include this authentication cookie. So, if you can execute JS in the context of facebook.com, you could steal this cookie or have the browser perform malicious actions that get implicitly authenticated.

Reply on news.ycombinator.com