Michał Bentkowski (@SecurityMB)Personal page of Michał Bentkowski, containing blog posts, research and others.https://www.bentkowski.info/Chromium: Same Origin Policy bypass within a single site a.k.a. "Google Roulette"https://www.bentkowski.info/2022/11/google-roulette/https://www.bentkowski.info/2022/11/google-roulette/Chromium bug allowing to bypass Same Origin Policy with a little help from DevToolsWed, 16 Nov 2022 00:00:00 GMTAnother XSS in Google Colaboratoryhttps://www.bentkowski.info/2018/09/another-xss-in-google-colaboratory/https://www.bentkowski.info/2018/09/another-xss-in-google-colaboratory/XSS in Google Colaboratory via re-enabling AssistiveMathML in cookieThu, 20 Sep 2018 00:00:00 GMTVulnerability in Hangouts Chat: from open redirect to code executionhttps://www.bentkowski.info/2018/07/vulnerability-in-hangouts-chat-aka-how/https://www.bentkowski.info/2018/07/vulnerability-in-hangouts-chat-aka-how/How an open redirect can lead to remote code execution in Electron appMon, 23 Jul 2018 00:00:00 GMTXSS in Google Colaboratory + CSP bypasshttps://www.bentkowski.info/2018/06/xss-in-google-colaboratory-csp-bypass/https://www.bentkowski.info/2018/06/xss-in-google-colaboratory-csp-bypass/XSS in Google Colaboratory via MathJax libraryThu, 21 Jun 2018 00:00:00 GMTSetting arbitrary request headers in Chromium via CRLF injectionhttps://www.bentkowski.info/2018/06/setting-arbitrary-request-headers-in/https://www.bentkowski.info/2018/06/setting-arbitrary-request-headers-in/Chromium bug in `csp` parameter of iframes allowing to inject arbitrary headersWed, 20 Jun 2018 00:00:00 GMTYet Another Google Caja bypasses hat-trickhttps://www.bentkowski.info/2017/11/yet-another-google-caja-bypasses-hat/https://www.bentkowski.info/2017/11/yet-another-google-caja-bypasses-hat/Three XSS-es in Google Caja via new ECMAScript featuresThu, 30 Nov 2017 00:00:00 GMTFirefox - Same-Origin Policy bypass (CVE-2015-7188)https://www.bentkowski.info/2016/07/firefox-same-origin-policy-bypass-cve/https://www.bentkowski.info/2016/07/firefox-same-origin-policy-bypass-cve/Same-Origin-Policy bypass via some obscure IP parsing in FirefoxTue, 05 Jul 2016 00:00:00 GMTXSS-es in Google Cajahttps://www.bentkowski.info/2016/07/xss-es-in-google-caja/https://www.bentkowski.info/2016/07/xss-es-in-google-caja/Three XSS-es in Google Caja abusing alternative syntax for tokens in JSSun, 03 Jul 2016 00:00:00 GMTXSS via file upload - www.google.com (Postini Header Analyzer)https://www.bentkowski.info/2015/05/xss-via-file-upload-wwwgooglecom/https://www.bentkowski.info/2015/05/xss-via-file-upload-wwwgooglecom/Story of XSS and XSS filter bypass via archive formatsTue, 12 May 2015 00:00:00 GMTXSS via window.stop() - Google Safen Uphttps://www.bentkowski.info/2015/05/xss-via-windowstop-google-safen-up/https://www.bentkowski.info/2015/05/xss-via-windowstop-google-safen-up/XSS via proper timing of window.stop()Fri, 01 May 2015 00:00:00 GMTXSS via Host header - www.google.com/csehttps://www.bentkowski.info/2015/04/xss-via-host-header-cse/https://www.bentkowski.info/2015/04/xss-via-host-header-cse/Abusing IE11 behavior to set your own Host header and conduct XSSWed, 22 Apr 2015 00:00:00 GMTSo Google sent me a package...https://www.bentkowski.info/2015/01/so-google-sent-me-package/https://www.bentkowski.info/2015/01/so-google-sent-me-package/A little story about a gift I got from GoogleSun, 25 Jan 2015 00:00:00 GMTFacebook and two dots leakhttps://www.bentkowski.info/2014/09/in-this-post-ill-explain-to-you/https://www.bentkowski.info/2014/09/in-this-post-ill-explain-to-you/Chromium on macOS parsed two dots in domain names as one dot... and that led to security issue!Mon, 15 Sep 2014 00:00:00 GMTGoogle Doodle - XSS (actually response splitting)https://www.bentkowski.info/2014/07/google-doodle-xss-actually-response/https://www.bentkowski.info/2014/07/google-doodle-xss-actually-response/A story of unexpected response splitting in google.comThu, 17 Jul 2014 00:00:00 GMTGmail and Google+ - tale of two XSS-eshttps://www.bentkowski.info/2014/06/gmail-and-google-tale-of-two-xss-es/https://www.bentkowski.info/2014/06/gmail-and-google-tale-of-two-xss-es/A story of two XSS-es; including one via cookieSat, 14 Jun 2014 00:00:00 GMTEaster eggs in Google Bug Bountyhttps://www.bentkowski.info/2014/04/easter-eggs-in-google-bug-bounty/https://www.bentkowski.info/2014/04/easter-eggs-in-google-bug-bounty/A list of a few easter eggs in the older bug bounty report pageSat, 26 Apr 2014 00:00:00 GMTGoogle Code Playground - Path Traversalhttps://www.bentkowski.info/2014/04/google-code-playground-path-traversal/https://www.bentkowski.info/2014/04/google-code-playground-path-traversal/Path Traversal in Google Code PlaygroundMon, 07 Apr 2014 00:00:00 GMTGetting startedhttps://www.bentkowski.info/2014/03/getting-started/https://www.bentkowski.info/2014/03/getting-started/Just saying hello!Sun, 30 Mar 2014 00:00:00 GMT