Marginwidth/marginheight - the unexpected cross-origin communication channel - research.securitum.comThe code just iterates over all attributes of the <body> element and evaluates values of all these attributes as JavaScript. Because there was no other sources in the challenge, it meant that solving it requires finding a way to inject arbitrary attribute value into the document.body. So how’s that possible? It all started when I noticed an interesting snippet in the HTML specification. The 14th s
