CSS Exfiltration Vulnerabilities in Google, Microsoft, and Yahoo Webmail Clients
Researchers from PortSwigger and SonarSource have identified a critical vulnerability class enabling CSS-based data exfiltration within major webmail clients, including Gmail, Outlook, and Yahoo. By leveraging advanced CSS attribute selectors and boundary escape techniques, attackers can bypass email sandboxing to interact with the underlying Document Object Model (DOM). This allows for the exfiltration of sensitive credentials, session tokens, and authentication data via side-channel requests—such as background-image: url()—to attacker-controlled servers. The attack vector further extends to UI hijacking and the manipulation of AI-powered email assistants, potentially leading to full third-party account takeover.
FROST: Malicious Website Exploitation of SSD/NVMe Timing Side-Channels in Google Chrome, Mozilla Firefox, and Brave
The FROST attack is a hardware-level timing side-channel vulnerability that allows malicious websites to conduct high-fidelity user surveillance by analyzing I/O latency signals from NVMe SSD controllers. By leveraging high-resolution browser APIs to measure micro-delays in disk read/write operations, an attacker can fingerprint the specific I/O signatures generated by local applications and operating system processes. This exploitation occurs via a passive "drive-by" mechanism, requiring no user interaction or privileged system access, and fundamentally circumvents existing browser security boundaries, including the Same-Origin Policy (SOP), sandboxing, and privacy-preserving modes such as Incognito or cookie-blocking extensions. Because the signal is derived from shared physical hardware rather than software-defined identifiers, the attack remains invisible to traditional endpoint detection and response (EDR) tools and browser-based privacy mitigations.
Full-Chain Exploitation of Pterodactyl: From Directory Traversal to Kernel-Level Compromise
This intelligence report details a sophisticated, multi-stage attack chain targeting the Pterodactyl game-server management panel, transitioning from unauthenticated web exploitation to full kernel-level compromise. The research demonstrates how an attacker can chain disparate vulnerabilities across the application, operating system, and Linux kernel to achieve total host takeover.