We’ll see a lot more of this soon, considering more and more software is moving ...

dmix · on April 8, 2016

Implementing CSP and other mitigations for these types of same origin bypass attacks is relatively easy. I'm shocked that Apple didn't check this. I couldn't imagine Google ever making this mistake, their web security teams are solid.

Apple really needs to invest heavily in bug bounties and internal security audits. This is 101 type of stuff when implementing any user-controllable embedded web content.

The bar should never be this low for critical OS apps like iMessage.

kuschku · on April 9, 2016

> I couldn't imagine Google ever making this mistake, their web security teams are solid.

You haven’t seen their XML bugs in Google Toolbar’s web gallery in 2013, have you? Full access to the whole file system of their servers via XML includes.

A bunch of security researchers managed to dump /etc/passwd as a sample to get the bug bounty.

Google’s security isn’t that much better either...