Web applications have become increasingly significant with the rise of the internet during this decade. Browsers, the medium through which web applications are accessed, must adhere to the design and implementation of security policies and mechanisms to protect their users from potential security risks. The most notable of these policies are Same Origin Policy (SOP) and Content Security Policy (CSP). However, due to the increasing complexity of modern browsers and operating systems, memory corruption exploitation has become difficult, making vulnerability classes such as SOP Bypass, UXSS, spoofing, Cross File attacks etc more prevalent. Mobile browsers, however, are relatively new and, as a result, have not undergone the same level of scrutiny as web browsers. Hundreds of families of different mobile browsers exist, each advertising a different set of capabilities. These browsers often incorporate new features and functionalities without having undergone systematic security checks, which widens the threat surface. In this presentation, the author will discuss a methodology for discovering novel security vulnerabilities in browsers, including address bar spoofing. The presentation will include a walkthrough of novel vulnerabilities discovered by the author.

 

The author will demonstrate how these bugs can be used to evade antiphishing, site reputation-based filters, as well as exploit password managers in modern browsers. Challenges and pitfalls with modern mobile browsers in terms of security and possible solutions to overcome them will also be discussed.