Get the latest tech news

Bypassing Google's big anti-adblock update

Or, why you shouldn't write parts of your browser in JavaScript

But in the old days, Google decided it'd be a good idea to inject a bunch of JS files into pages that used Chrome APIs. Turns out running privileged JavaScript in user-controlled websites was not a good idea, because JS can often be manipulated by overriding global functions and prototypes. Since certain APIs like chrome.runtime exist on normal websites too, the extension bindings system led to multiple Universal XSS bugs back in 2015 and 2016.

Get the Android app