5 ms·
https://developer.mozilla.org/en-US/docs/Web/API/Location/replace https://developer.mozilla.org/en-US/docs/Web/API/Location/re... This is known and commonly us
by jerbearito 2mo ago
https://developer.mozilla.org/en-US/docs/Web/API/Location/replace https://developer.mozilla.org/en-US/docs/Web/API/Location/re...
This is known and commonly used -- since 1996. What's the risk? You can't change records about other domains.
- hyperhello 2mo agoI knew about history.replace but I had no idea you could cross sites. Suppose a site, for example, leaves a trail of Amazon Shopping, and curious, you go to it to recall what you did, but it’s Amaz0n instead.
- post-it 2mo agoWell there's no need to suppose. While I think if it hasn't been exploited in 30 years, there probably isn't an attack surface, you can always demonstrate and report an exploit.
- deleted 2mo ago[deleted]
- hilariously 2mo agoI dont think its highly exploitable, but you could get people in trouble - have them visit innocuous website during a vulnerable time window, spray a bunch of adult websites into their history, report them to the boss, future visits do not inject history items.
- aaron695 2mo ago[dead]