corpus.blog
41554 blogs · [ { "id": "01a0821c-33e0-72d8-a3ce-aeaa3fc916b0", "title": "The S in interoperability", "url": "https://frederikbraun.de/the-s-in-interoperability.html", "published_at": "2026-05-30T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa403e9b52", "title": "Multiple things can be true at the same time", "url": "https://frederikbraun.de/feels-and-llms.html", "published_at": "2026-04-22T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa406bf8e0", "title": "Composing Sanitizer configurations", "url": "https://frederikbraun.de/composable-sanitizers.html", "published_at": "2026-03-07T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa41666d76", "title": "Perfect types with `setHTML()`", "url": "https://frederikbraun.de/perfect-types-with-sethtml.html", "published_at": "2026-03-06T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4264cc5e", "title": "Why the Sanitizer API is just setHTML()", "url": "https://frederikbraun.de/why-sethtml.html", "published_at": "2025-12-06T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa42bf6b0e", "title": "The C3PO Bug in Lego Star Wars: The Complete Saga", "url": "https://frederikbraun.de/lego-star-wars-complete-saga-c3po-bug.html", "published_at": "2025-12-05T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4396e046", "title": "With Carrots & Sticks - Can the browser handle web security?", "url": "https://frederikbraun.de/madweb-keynote-2025.html", "published_at": "2025-04-07T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa444acbb5", "title": "Home assistant can not be secured for internet access", "url": "https://frederikbraun.de/home-assistant-can-not-be-secured-for-internet-access.html", "published_at": "2024-12-14T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4527ecff", "title": "Modern solutions against cross-site attacks", "url": "https://frederikbraun.de/modern-solutions-xsleaks.html", "published_at": "2024-11-25T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa45ccfa0c", "title": "Prompt Injections and a demo", "url": "https://frederikbraun.de/prompt-injections-and-a-demo.html", "published_at": "2024-09-17T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa46a78f93", "title": "The Mozilla Monument in San Francisco", "url": "https://frederikbraun.de/mozilla-monument.html", "published_at": "2024-07-04T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4769d999", "title": "What is mixed content?", "url": "https://frederikbraun.de/mixed-content.html", "published_at": "2024-06-14T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4845766d", "title": "How I got a new domain name", "url": "https://frederikbraun.de/new-domain.html", "published_at": "2024-06-14T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa485b9b35", "title": "How Firefox gives special permissions to some domains", "url": "https://frederikbraun.de/special-browser-privileges-for-some-domains.html", "published_at": "2024-02-01T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa49183a1c", "title": "Examine Firefox Inter-Process Communication using JavaScript in 2023", "url": "https://frederikbraun.de/examine-firefox-inter-process-communication-using-javascript-in-2023.html", "published_at": "2023-04-16T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa49ab3385", "title": "Origins, Sites and other Terminologies", "url": "https://frederikbraun.de/origins-sites-and-other-terminologies.html", "published_at": "2023-01-13T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4a45404d", "title": "Finding and Fixing DOM-based XSS with Static Analysis", "url": "https://frederikbraun.de/finding-and-fixing-dom-based-xss-with-static-analysis.html", "published_at": "2023-01-01T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4ab0ec26", "title": "DOM Clobbering", "url": "https://frederikbraun.de/dom-clobbering.html", "published_at": "2022-12-11T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4af1f2c8", "title": "Neue Methoden für Cross-Origin Isolation: Resource, Opener & Embedding Policies mit COOP, COEP, CORP und CORB", "url": "https://frederikbraun.de/neue_methoden_cross_origin_isolation.html", "published_at": "2022-11-09T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4b7d1106", "title": "Reference Sheet for Principals in Mozilla Code", "url": "https://frederikbraun.de/principals-reference.md.html", "published_at": "2020-08-02T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4bd3529a", "title": "Hardening Firefox against Injection Attacks – The Technical Details", "url": "https://frederikbraun.de/hardening-firefox-against-injection-attacks-the-technical-details.html", "published_at": "2020-07-06T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4c105071", "title": "Understanding Web Security Checks in Firefox (Part 1)", "url": "https://frederikbraun.de/understanding-web-security-checks-in-firefox-part-1.html", "published_at": "2020-06-09T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4c22af79", "title": "Help Test Firefox's built-in HTML Sanitizer to protect against UXSS bugs", "url": "https://frederikbraun.de/test-firefox-xss-sanitizer.html", "published_at": "2019-12-05T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4cbc636f", "title": "Remote Code Execution in Firefox beyond memory corruptions", "url": "https://frederikbraun.de/firefox-ui-xss-leading-to-rce.html", "published_at": "2019-09-28T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4db0315c", "title": "XSS in The Digital #ClimateStrike Widget", "url": "https://frederikbraun.de/xss-digital-climate-strike.html", "published_at": "2019-09-22T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4e79ebd0", "title": "Chrome switching the XSSAuditor to filter mode re-enables old attack", "url": "https://frederikbraun.de/xssauditor-bad.html", "published_at": "2019-05-09T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4e9b5de1", "title": "Challenge Write-up: Subresource Integrity in Service Workers", "url": "https://frederikbraun.de/sw-sri-challenge.html", "published_at": "2017-03-24T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4efec68c", "title": "Finding the SqueezeBox Radio Default SSH Password", "url": "https://frederikbraun.de/squeezebox-radio-ssh-default-password.html", "published_at": "2016-09-01T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa4fc1635e", "title": "New CSP directive to make Subresource Integrity mandatory (`require-sri-for`)", "url": "https://frederikbraun.de/new-csp-directive-to-make-subresource-integrity-mandatory-require-sri-for.html", "published_at": "2016-06-01T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa502dc2f7", "title": "Firefox OS apps and beyond", "url": "https://frederikbraun.de/firefox-os-apps-and-beyond.html", "published_at": "2016-04-11T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa50555100", "title": "Teacher's Pinboard Write-up", "url": "https://frederikbraun.de/teachers-pinboard-hack-lu-2015.html", "published_at": "2015-12-01T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa513dfc59", "title": "A CDN that can not XSS you: Using Subresource Integrity", "url": "https://frederikbraun.de/using-subresource-integrity.html", "published_at": "2015-07-18T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa51d05c66", "title": "The Twitter Gazebo", "url": "https://frederikbraun.de/twitter-gazebo.html", "published_at": "2015-07-17T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa5208c3a9", "title": "German Firefox 1.0 ad (OCR)", "url": "https://frederikbraun.de/firefox-faz-ocr.html", "published_at": "2014-11-08T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa52f74045", "title": "My thoughts on Tor appliances", "url": "https://frederikbraun.de/thoughts-on-tor-appliances.html", "published_at": "2014-10-13T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa53765d7b", "title": "Subresource Integrity", "url": "https://frederikbraun.de/subresource-integrity.html", "published_at": "2014-10-04T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa537a141b", "title": "Revoke App Permissions on Firefox OS", "url": "https://frederikbraun.de/revoking-permissions-on-firefox-os.html", "published_at": "2014-08-23T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa542e829d", "title": "(Self) XSS at Mozilla's internal Phonebook", "url": "https://frederikbraun.de/self-xss.html", "published_at": "2014-05-22T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa542f56ad", "title": "Tales of Python's Encoding", "url": "https://frederikbraun.de/rot13-encoding-in-python.html", "published_at": "2014-03-16T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa54731a19", "title": "On the X-Frame-Options Security Header", "url": "https://frederikbraun.de/x-frame-options-security-header.html", "published_at": "2013-12-11T23:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa54fba5eb", "title": "html2dom", "url": "https://frederikbraun.de/html2dom.html", "published_at": "2013-09-23T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa55181106", "title": "Security Review: HTML sanitizer in Thunderbird", "url": "https://frederikbraun.de/secreview-750436.html", "published_at": "2013-07-21T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa55c6bc60", "title": "Week 29 2013", "url": "https://frederikbraun.de/2013-wk-29.html", "published_at": "2013-07-20T22:00:00+00:00" }, { "id": "01a0821c-33e0-72d8-a3ce-aeaa5667c80f", "title": "The First Post", "url": "https://frederikbraun.de/first-post.html", "published_at": "2013-07-15T22:00:00+00:00" } ] posts Claim your blog
Back to Frederik Braun
Blog · corpus.blog/blogs/frederikbraun.de/posts

Frederik Braun

frederikbraun.de

2026

The S in interoperabilityoriginal ↗
30 May 2026
Multiple things can be true at the same timeoriginal ↗
22 Apr 2026
Composing Sanitizer configurationsoriginal ↗
7 Mar 2026
Perfect types with `setHTML()`original ↗
6 Mar 2026

2025

Why the Sanitizer API is just setHTML()original ↗
6 Dec 2025
The C3PO Bug in Lego Star Wars: The Complete Sagaoriginal ↗
5 Dec 2025
With Carrots & Sticks - Can the browser handle web security?original ↗
7 Apr 2025

2024

Home assistant can not be secured for internet accessoriginal ↗
14 Dec 2024
Modern solutions against cross-site attacksoriginal ↗
25 Nov 2024
Prompt Injections and a demooriginal ↗
17 Sept 2024
The Mozilla Monument in San Franciscooriginal ↗
4 Jul 2024
What is mixed content?original ↗
14 Jun 2024
How I got a new domain nameoriginal ↗
14 Jun 2024
How Firefox gives special permissions to some domainsoriginal ↗
1 Feb 2024

2023

Examine Firefox Inter-Process Communication using JavaScript in 2023original ↗
16 Apr 2023
Origins, Sites and other Terminologiesoriginal ↗
13 Jan 2023
Finding and Fixing DOM-based XSS with Static Analysisoriginal ↗
1 Jan 2023

2022

DOM Clobberingoriginal ↗
11 Dec 2022
Neue Methoden für Cross-Origin Isolation: Resource, Opener & Embedding Policies mit COOP, COEP, CORP und CORBoriginal ↗
9 Nov 2022

2020

Reference Sheet for Principals in Mozilla Codeoriginal ↗
2 Aug 2020
Hardening Firefox against Injection Attacks – The Technical Detailsoriginal ↗
6 Jul 2020
Understanding Web Security Checks in Firefox (Part 1)original ↗
9 Jun 2020

2019

Help Test Firefox's built-in HTML Sanitizer to protect against UXSS bugsoriginal ↗
5 Dec 2019
Remote Code Execution in Firefox beyond memory corruptionsoriginal ↗
28 Sept 2019
XSS in The Digital #ClimateStrike Widgetoriginal ↗
22 Sept 2019
Chrome switching the XSSAuditor to filter mode re-enables old attackoriginal ↗
9 May 2019

2017

Challenge Write-up: Subresource Integrity in Service Workersoriginal ↗
24 Mar 2017

2016

Finding the SqueezeBox Radio Default SSH Passwordoriginal ↗
1 Sept 2016
New CSP directive to make Subresource Integrity mandatory (`require-sri-for`)original ↗
1 Jun 2016
Firefox OS apps and beyondoriginal ↗
11 Apr 2016

2015

Teacher's Pinboard Write-uporiginal ↗
1 Dec 2015
A CDN that can not XSS you: Using Subresource Integrityoriginal ↗
18 Jul 2015
The Twitter Gazebooriginal ↗
17 Jul 2015

2014

German Firefox 1.0 ad (OCR)original ↗
8 Nov 2014
My thoughts on Tor appliancesoriginal ↗
13 Oct 2014
Subresource Integrityoriginal ↗
4 Oct 2014
Revoke App Permissions on Firefox OSoriginal ↗
23 Aug 2014
(Self) XSS at Mozilla's internal Phonebookoriginal ↗
22 May 2014
Tales of Python's Encodingoriginal ↗
16 Mar 2014

2013

On the X-Frame-Options Security Headeroriginal ↗
11 Dec 2013
html2domoriginal ↗
23 Sept 2013
Security Review: HTML sanitizer in Thunderbirdoriginal ↗
21 Jul 2013
Week 29 2013original ↗
20 Jul 2013
The First Postoriginal ↗
15 Jul 2013