Alesandro Ortiz: Software Engineer. Security Researcher.
Summary Some mobile apps offer a feature to share local device content to other devices using the Cast or AirPlay protocols. Some apps implement this feature, in part, by running a web server that provides access to local files. Other devices on the network can access these web servers running on a mobile device. An improperly configured server can provide access to user-downloaded files or…
This tool allows you to quickly download the latest Chromium AddressSanitizer (ASan) builds, according to data from the storage bucket and ChromiumDash . Since March 16, 2022, this tool shows release ASan builds for Windows, ChromeOS, Linux, and Mac. Previously it only showed Windows builds. On August 4th, 2022, Chromium added a Python script to get ASan builds: get_asan_chrome.py Don't miss any…
Summary CVE-2020-6506 ( crbug.com/1083819 ) is a universal cross-site scripting (UXSS) vulnerability in Android WebView which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects vendors which use Android WebView with a default configuration setting, and whose apps run on systems with Android WebView version prior to 83.0.4103.106…
September-December 2020 Over the next few weeks I'll publish several articles on fixed vulnerabilities I've discovered over the past couple of years. Most of the vulnerability details have not been previously disclosed, so this website will be the first to publicly publish details. (Don't miss any research: Get new articles via email. ) A few other vulnerabilities have been disclosed by vendors…