@securitymb@infosec.exchange Profile
@[email protected]

@SecurityMB

Followers
11K
Following
919
Statuses
1K

Improving the world’s security at Google. Opinions are mine.

Zurich, Switzerland
Joined September 2014
Don't wanna be here? Send us removal request.
@SecurityMB
Finally, my research is published. It has everything you might wish for in browser security: universal XSS, mutation XSS, CSS data exfiltration, and others. Check this out! In a few days, we'll also release a 30-minute presentation about this topic.
@securitum_com
Securitum
@securitum_com
5 years
We are publishing the research of Copy&Paste issues in browsers by @SecurityMB. Over $30k in bounties for bugs in Chromium, Firefox, Safari, Google Docs, Gmail, TinyMCE, CKEditor, and others. Includes also 0-day in Froala.
8
114
412
@SecurityMB
RT @GoogleVRP: Celebrating 15 years of password hacking 💻 🔑, Swiss Army knives (and sometimes even chainsaws or swords) included! 😲 Disco…
0
32
0
@SecurityMB
RT @OMHconf: Pewien inżynier bezpieczeństwa musi zadbać o bezpieczeństwo dosłownie tysięcy aplikacji. 💥 Jak to osiągnąć? Michał Bentkowsk…
0
2
0
@SecurityMB
Reading about new mXSS techniques always warms my heart. Amazing writeup @kevin_mizu and great bugs!
@kevin_mizu
Kévin GERVOT (Mizu)
@kevin_mizu
3 months
I'm thrilled to finally share my research on HTML parsing and DOMPurify at @GreHack 2024 📜 The research article is available here: The slides are available here: 1/3
Tweet media one
1
1
36
@SecurityMB
RT @GoogleVRP: Do you want to learn more about the various Vulnerability Reward Programs offered by Google? Or you're looking for inspirati…
0
10
0
@SecurityMB
RT @zoczus: It's always nice to talk with Mr @SecurityMB 🔥
Tweet media one
0
1
0
@SecurityMB
Check out the video in which I’m talking with @kkotowicz about Google VRPs. Learn how you can start hacking Google! Let me know if there’s something you’d like us to cover in future videos 😀
3
9
43
@SecurityMB
@S1r1u5_ I feel like most sanitizers are doomed when you add MathML tags to the allowlist.
0
0
5
@SecurityMB
RT @lukOlejnik: Very nice presentation about web security at a scale by @SecurityMB. Finally, web security is solved for good. https://t.co…
0
1
0
@SecurityMB
@zcorpan @S1r1u5_ Do you think it's feasible? For me it feels like changing parsing of SVG title/style/script would be quite a big change spec-wise.
1
0
0
@SecurityMB
[PL] Zapraszam na MSHP do Krakowa! Sam też będę miał tam prezentację 😀
@Sekurak
Sekurak
@Sekurak
6 months
Dołączysz do konferencji Mega Sekurak Hacking Party? ✅ Trzy ścieżki prezentacji: Główna (topowe / świeże tematy związane z ITsec), Hacking Depot (hackowanie na żywo), Intro (dla początkujących) ✅ Same premierowe prezentacje! ✅ Topowi prowadzący-praktycy, znani ze sceny ITsec w Polsce i za granicą ✅ Na miejscu premiera nowej książki sekuraka! Oraz możliwość spotkania z autorami ✅ -15% z kodem: sekurak-mega Szczegóły oraz zapisy:
Tweet media one
1
0
5
@SecurityMB
@zcorpan You’re welcome! Also this one is open source: so any contributions are welcome 😅
0
0
1
@SecurityMB
@zcorpan New version is here:
1
1
1
@SecurityMB
@ericlaw There's a proposal: but I'm not sure what its current status. What you can do is to create a sandboxed iframe, and call from the iframe.
1
0
3
@SecurityMB
@shhnjk Savage
0
0
3
@SecurityMB
@mvsamuel @garethheyes I guess you mean this (which is directly in the ECMAScript spec):
0
0
0
@SecurityMB
@garethheyes Hands-down my favorite HTML parsing quirk 😀
0
0
2
@SecurityMB
Google VRP significantly increases reward amounts! Just go and hack 😀
@GoogleVRP
Google VRP (Google Bug Hunters)
@GoogleVRP
7 months
🚨💰 Google VRP Reward Update 💰🚨 Good news, we are significantly increasing the reward amounts offered by the Google VRP! Look out for up to 5x higher payouts and a maximum reward of $151,515! Details here:
1
0
14
@SecurityMB
@gynvael @lukOlejnik As far as I know, per spec there is basically no limit. I'm not sure what are the practical limits in browsers though.
1
0
2
@SecurityMB
RT @GoogleVRP: 🚫 DOM XSS, begone! 👋 Discover how we used Trusted Types to protect AppSheet, and how that can inform your own web applicatio…
0
37
0