6 replies

1. Jim Nielsen 5 min later

   @zachleat you gotta love it when vulnerability disclosures by security researchers are blog posts with BLACK backgrounds and pixelated graphics moving across the page. that's when you know it's legit.

   1. Zach Leatherman 8 min later

      @jimniels before vibe coding we had only vibes

2. Jason Garber 49 min later

   @zachleat love me some catastrophic security flaws in my web browser software

   1. Zach Leatherman 52 min later

      @jgarber I’m not sure if this issue even communicates the depth of the original problem — how long did they let folks share Boosts with arbitrary JavaScript in them? This truly seems like XSSaaS to me

      1. Jason Garber 1 hr later

         @zachleat XSStremely yikes

3. amd 2 hr later

   @zachleat yikes. That’s a bad one.