back in 2022 i found a bug that would let me, with no user interaction, turn any chromium-based browser into a permanent js botnet member

[gurkan@has.siktir.in]

@rebane2001 peak google efficiency

[egerlach@hachyderm.io]

@rebane2001 Clearly, @mozilla's choices around not implementing certain APIs is paying off.

[skyr@chaos.social]

@rebane2001 BeEF module ftw!

[rebane2001@infosec.exchange]

issue set to private again, hopefully it'll get fixed properly this time

[sylvhem@eldritch.cafe]

@rebane2001 Oops.

[alesandroortiz@infosec.exchange]

@rebane2001 Nice find! I should have woken up earlier to see the details.

[ratsnakegames@mastodon.social]

@rebane2001 fucking embarrassing

[samantazfox@infosec.exchange]

@rebane2001 Well, too late, it has already been archived :x

[rebane2001@infosec.exchange]

@SamantazFox out of curiosity, where? the archive.org captures don't load for me

edit: ty

[lenni@fosstodon.org]

@rebane2001 @SamantazFox It's on archive.today/.is/.ph. Only go there with a content blocker, you're DDoSing a small blog otherwise: https://gyrovague.com/2026/02/01/archive-today-is-directing-a-ddos-attack-against-my-blog/

[fuzzyfuzzyfungus@cyberplace.social]

@rebane2001 I hate it; but damn that's clever.

[shravanrn@infosec.exchange]

@rebane2001 really cool work. Didn't realize this sort of bug class even existed. Hope they up the bounty; this seems worth more than $1000

[rebane2001@infosec.exchange]

@Strabisme @cR0w yes, provided you disable js or service workers on the page