Skip to content(if available)orjump to list(if available)

Trick users and bypass warnings – Modern SVG Clickjacking attacks

Trick users and bypass warnings – Modern SVG Clickjacking attacks

2 comments

·December 5, 2025
Visit

autoexec

I already keep SVG disabled for security reasons, but it's increasingly looking like I'll have to find some way to disable CSS too. It's too bad people couldn't leave CSS alone as a nice simple (sort of) way to format text because turning it into another programing langue is begging for it to be abused by hackers and other malicious actors (like advertisers) just like JS

paulpauper

nah, that is overkill. the probability of falling for this is still tiny and it cannot break the sandbox, steal session cookies, or anything like that .