Gal Weizman

Reading this title, you might be thinking, “dude’s late to the party” Well, to an extent, yes But also, diving deep into browser extensions security in the past 6 months was eye-opening to me, and while some of my realizations may seem obvious to most, I…

iframes can either share the origin of their embedder or not.

tl;dr This is one of my favorite essays so far: client side security is a niche tech field that seems to be unneeded for the most part.

Originally posted on X A recently published paper on Browser Wallets Security was just shared.

Originally posted on X THIS WAS MEANT TO BE POSTED 1 MONTH AGO, BEFORE THE OCTOBER 7TH EVENTS 🇮🇱 SOME DETAILS MAY BE OUT OF DATE Open Chrome devtools console @ https://weizmangal.com/awesome-javascript-anti-debugging and watch the entire chrome app CRASH @

Originally posted on X Last week we presented to @w3c and advocated for some ideas we believe could enhance security for web apps on behalf of @metamask.

Summary The following is taken from the official document “The Same Origin Concern” - please consider reading the full document.

Taken from the Pull Request that introduces this significant change #133 tl;dr - Today marks a big day in the life of Snow, where we come to the mature realization that in order for the project to stop chasing defensive security it has to take some bold s…

Originally posted on X You always hear about the prototype chain in #JavaScript, but why isn't there a way to actually see and play with it?

Originally posted on X After covering LavaMoat 🌋 scuttling #security feature and its fundamental issue of being unable to deny access to the "document" prop, which effectively eliminates its core concept, I implied we address that too with our in-house se…

Originally posted on X In Last week's tweet (↓) we discussed "scuttling", a LavaMoat 🌋 feature we enable on MetaMask 🦊 for enhanced supply chain security.

Originally posted on X MetaMask 🦊 is an amazing app for many reasons.

Originally posted on X You know how in browser JS if an attached element has an ID (e.g.

tl;dr - ???

tl;dr tl;dr - a stored XSS in Snyk Advisor (domain:snyk.io) allowed me to fabricate the health score granted for packages in my control, which I leveraged into making it seem as my “malicious” package is in fact healthy, popular and legitimate, which could

Originally posted on X Nothing too exciting about yet another stored #XSS on a public security service.

Originally posted on X Excited to introduce the experimental ⚠️ #LavaMoat 🌋 toolbox technology, Snow JS ❄️ 🧵 Snow is an advanced and an important solution to a complicated sub problem in #browser #javascript #SupplyChainAttacks #security:github.com/lavamo…

Originally posted on X Now that we understand: 1.

By Gal Weizman @MetaMask In this document I will be arguing in favor of integrating the new and advanced Snow JS ❄️ browser security technology into the MetaMask 🦊 browser extension. tl;dr Supply chain attacks is a massive problem against javascript based…

As part of my long term research around browser JavaScript security, in the past year I have been focusing specifically on security for realms ⭐️.

tl;dr - Abusing the Chromium Devtools Scope Pane can allow execution of Javascript by the devtools while the main thread is paused by the debugger!

Introducing Securely 🔒, Snow ❄️ and Across ↔ tl;dr - Today I share my “side project” for the past year, three browser javascript security libraries that aim to perform as tools for creating web apps that are more resilient to and limiting of unwanted code…

tl;dr - This is the story of how I found and helped Google patch a vulnerability in Chrome browser that could have allowed attackers to fully bypass CSP rules since Chrome 73 (March 2019), and how researching it taught me that today’s CSP mechanism design…

tl;dr - This is the story of how I found and helped Facebook patch multiple security flaws in WhatsApp, all the way from a simple Open-Redirect through a Persistent-XSS and CSP-bypass to a full cross platforms Read From The Local File System on both Windo…

Check out my first post where I share some cool insights regarding end of life events in the browser and a cool javascript trick to easily debug them both

Check out my next post on how to list every event possible in the browser and a graphical represantation I made to compare events support between different browsers

Later on was published on Medium tl;dr - Abusing SourceMappingURL feature can allow attackers to create one of the strongest Cross Browsers Javascript Anti Debugging techniques that was ever seen (fully detailed live demo) This article’s purpose is to int…