Luan Herrera

[Luan Herrera @lbherrera_]

I began looking into browser security issues again in 2026 and while reviewing extension permission APIs, I noticed that the default declarativeNetRequest API (which only requires permission to block content on all pages) can be leveraged into a side-channel attack.

This permission ends up allowing an extension to infer the full URL of open tabs without requesting the chrome.tabs permission, and it can also leak the full URL of cross-origin redirects.

Unfortunately, fixing this issue has been deemed unrealistic by Chrome, and the risk has been accepted, so it is worth keeping this in mind when granting content-blocking permissions to browser extensions.

The complete public report can be found at https://t.co/CI8miz1lL4.

[Luan Herrera @lbherrera_]

document.body.innerHTML = "&#x;"; console.log(document.body.innerHTML.length);

document.write("&#x;");
console.log(document.body.innerHTML.length);

🤔

[DaviMatsuyama @davi1337_]

Here we go. my DEF CON CTF writeup, a little different from the others. Also, thanks to Pwn de Queijo for letting me play with you guys.

https://t.co/6oQBZSKqoy

[Renwa @RenwaX23]

"Dad, what was it like playing CTFs before AI?"

[Luan Herrera @lbherrera_]

@caioluders Nos vemos no quals do ano que vem 😁

[Luan Herrera @lbherrera_]

@hash_kitten @kevin_mizu Interesting scenario, thanks! 🙂

[hashkitten @hash_kitten]

Posting a mini XSS challenge! Goal is to pop an alert. I believe this trick is not well known. Intended solution is chrome only. Thanks to @kevin_mizu for beta testing! Don't post solutions in the thread; DM only!

https://t.co/v5LXrs5ORk

[Luan Herrera @lbherrera_]

The end of an era for @GoogleVRP! 😢

[Hacktron AI @HacktronAI]

Introducing Hacktron Review: an AI security reviewer for your pull requests.

It understands your whole codebase, builds a threat model, takes your feedback, and catches exploitable vulnerabilities before they reach production.

Try for free: https://t.co/ZHfG7cvXRe

[Security Bug Aggregator @BugsAggregator]

[422531206][reward: $5000] Intersection Observer v2 API fails to correctly determine target's visibility for dynamically changed z-indexes, enabling clickjacking against Google One Tap
https://t.co/FrLze7NNRz

[s1r1us (mohan) @S1r1u5_]

I pointed claude opus at chrome and told it to build a full v8 exploit for discord.

A week of back-and-forth pulling it out of dead ends. 2.3B tokens. $2,283 in API costs, and it popped a shell.

https://t.co/vwj9d33Bvq

[caioluders @caioluders]

new tool

PEGA-PEGA

Multi-protocol request logger and catcher. Listens on 14 protocols, logs every incoming request, and displays them in a web dashboard and terminal UI.

https://t.co/KyXkcubKK4

[Rebane @rebane2001]

i built an entire x86 CPU emulator in CSS (no javascript)

you can write programs in C, compile them to x86 machine code with GCC, and run them inside CSS

[Hacktron AI @HacktronAI]

🚨 CVE-2026-1731 🚨

Our team discovered a critical pre-auth RCE affecting BeyondTrust Remote Support & Privileged Remote Access.

SaaS/Cloud instances have been patched. If you're running self-hosted deployments, apply the patches immediately. More info in the comments.

[Security Bug Aggregator @BugsAggregator]

[447172715][reward: $30000] Security: Compromised renderer can control mouse after single tap (UXSS, sandbox escape, and more)
https://t.co/dMRQiUwZpv

[Luan Herrera @lbherrera_]

@RenwaX23 I feel you! My record is 2660 days 😆

[Luan Herrera @lbherrera_]

Back on the Chrome VRP! 😁

[Youssef Sammouda (sam0) @samm0uda]

Datr cookie theft and AI leading to Facebook account takeover ($24,000)
https://t.co/n2MVZKxDBg
Two-click Facebook account takeover via FXAuth ($30,000) https://t.co/MtuvFzGRsS
Self-XSS in Facebook payments flow leads to account takeovers ($62,500)
https://t.co/D7qXu1Avim

[Youssef Sammouda (sam0) @samm0uda]

$312,500 worth of stored/reflected XSS vulnerabilities in Meta’s Conversions API Gateway allowed Javascript code to run on any Facebook domain and millions of third-party websites. The flaw enabled zero-click Facebook account takeover and more:

https://t.co/7gWpR4LQ8x