Skip to content

T.SAME_ORIGIN_VIOLATION misrepresents the purpose of sandboxing #30

@muchlikeacat

Description

@muchlikeacat

The third bullet in T.SAME_ORIGIN_VIOLATION:

  • Inadequate sandboxing of browser windows and tabs or a faulty cross domain communications model can lead to leakage of content from one domain in one window or tab to a different domain in a different window or tab. Such attacks leverage the ability of browsers to display content from multiple domains simultaneously.

indicates that sandboxing is a mitigation to help enforce the same origin policy. Sandboxing is primarily intended to protect the operating system from a compromised renderer process. Removing the reference to sandboxing here will make this bullet more accurate.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions