Loading story…
Security researchers demonstrated methods to bypass SameSite cookie protections in web applications, enabling successful Cross-Site Request Forgery (CSRF) attacks against a change email function. In one scenario, the application used the default SameSite=Lax setting, which allowed session cookies to be sent in cross-site GET requests during top-level navigation. By manipulating HTTP methods and leveraging the absence of unpredictable tokens, attackers could exploit this configuration to perform unauthorized actions on behalf of users. Another scenario involved SameSite=Strict cookies, where a client-side JavaScript redirect was identified as a potential vector to circumvent the strict cookie policy, again enabling CSRF attacks if exploited correctly.
These findings highlight the importance of properly configuring SameSite cookie attributes and implementing robust anti-CSRF tokens in sensitive web application endpoints. The research underscores that even with modern browser protections, creative exploitation of HTTP methods and client-side behaviors can undermine session security, emphasizing the need for defense-in-depth strategies in web application development and testing.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A web application's change-email function was found vulnerable to CSRF because the request lacked unpredictable anti-CSRF tokens. Researchers showed SameSite=Strict protections could be bypassed by abusing a client-side JavaScript redirect after comment submission, allowing an attacker to change a victim's email address.
A web application's change-email function was found vulnerable to CSRF because the request lacked unpredictable anti-CSRF tokens. The issue could be exploited despite default SameSite=Lax cookie behavior by using a top-level cross-site GET request with method override to trigger the email change.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
osintteam.blog
Open sourceosintteam.blog
Open sourceosintteam.blog
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and industry experts have highlighted significant risks associated with client-side JavaScript in modern web applications, emphasizing the limitations of traditional server-side defenses. A penetration tester discovered a reflected cross-site scripting (XSS) vulnerability in a critical web application, demonstrating how attackers can inject malicious scripts through user-modifiable fields, such as a license name, even with low-privilege accounts. The tester noted that while certain security measures like the HttpOnly cookie flag can prevent classic cookie theft via JavaScript, other attack vectors remain viable, especially when input validation is insufficient. Industry reports have shown that during peak shopping seasons, such as the holidays, attacks targeting client-side code have surged, with incidents like the Polyfill.io breach and Magecart attacks affecting hundreds of thousands of websites and compromising payment data. These attacks exploit the fact that web application firewalls (WAFs) and intrusion detection systems are blind to JavaScript execution within users' browsers, creating a significant visibility gap. The encrypted nature of modern web traffic further complicates detection, as network monitoring tools cannot easily inspect data sent to third-party domains. Security experts warn that compliance tools and client-side security agents, such as JavaScript monitoring scripts and Content Security Policy (CSP) headers, can often be bypassed by attackers using well-known browser behaviors and design limitations. Techniques to evade these controls include manipulating JavaScript agents, circumventing CSP restrictions, and avoiding detection by automated crawlers. The effectiveness of these bypasses underscores the need for organizations to rigorously test their client-side security and compliance tools, rather than relying solely on checkbox compliance. Defensive recommendations include adopting more robust monitoring of third-party scripts, implementing layered security controls, and ensuring responsible disclosure of discovered vulnerabilities. The evolving threat landscape requires organizations to address both server-side and client-side risks, as attackers increasingly target the browser environment where traditional defenses are ineffective. Security professionals advocate for a proactive approach to client-side security, including regular penetration testing, comprehensive monitoring, and continuous improvement of defensive measures. The combination of real-world vulnerability discoveries and industry-wide attack trends demonstrates that client-side security remains a critical and often underappreciated aspect of web application defense. Organizations are urged to close visibility gaps and strengthen their client-side protections to prevent data theft and maintain customer trust. The ongoing evolution of attack techniques necessitates vigilance and adaptation in both technical controls and security policies.
Jul 12, 2026
Multiple web application labs demonstrate how flawed access control mechanisms can be exploited to escalate privileges. In one scenario, method-based access control is circumvented by manipulating HTTP request methods, allowing a non-admin user to perform administrative actions. Another lab highlights the risks of relying on the `Referer` header for access control, showing that attackers can bypass restrictions by crafting requests with manipulated headers and session cookies. A third lab exposes a multi-step process vulnerability, where the absence of access control on a critical step enables unauthorized role changes by replaying requests with altered session data. These labs underscore the dangers of implementing weak or incomplete access control checks, particularly when relying on easily manipulated HTTP methods or headers. The demonstrations provide practical examples of how attackers can exploit such flaws using tools like Burp Suite to intercept and modify requests, emphasizing the need for robust, defense-in-depth access control strategies in web applications.
Jul 12, 2026
Researchers disclosed a Chrome vulnerability that could bypass `SameSite=Strict` cookie protections when a target website had a registered service worker and a victim opened Chrome DevTools. A cross-site POST initially sent without cookies could be replayed by the Inspector Resource Content Loader using the invalid `kNoCors` and `kOnlyIfCached` combination; the target site's service worker could then refetch the request in its own origin context, causing Strict cookies to be attached. The flaw could enable CSRF-style actions, including unauthorized account or password changes and financial transfers. Chrome's Vulnerability Reward Program rated the report S3/P2 and fixed the issue by changing the loader request mode to `kSameOrigin` while retaining `kOnlyIfCached`. Researchers also reported a related cache and request-resubmission path involving Ctrl+U and page refresh behavior as Issue-470629629.
Sep 2, 2026