[ororlrlrlylyly]

Wait a second, could you not read my google login session cookie from this page with a seamless iframe to a google domain? Again, like the person above, I didn't really understand what's going on here.

[homakov]

no cookie/XSS or any real vuln here involved. This is completely standard design problem of sandbox domain. Check out http://homakov.github.io/guc.html

[ororlrlrlylyly]

Oh, btw, also, you may be interested in window.setTimeout.

[homakov]

i am js jedi, but don't spend much time on PoCs.

[sluukkonen]

Google uses a different domain for user content, namely googleusercontent.com.

[ororlrlrlylyly]

What's the definition of "user content"?

[homakov]

Untrustworthy scripts, HTML, images, email attachments.

[ororlrlrlylyly]

But I'm logged in! It shows myname in the corner. So obviously you could get that cookie, right?

[homakov]

Part with yourname is other_origin. I change content of GUC Page 2 using GUC Page 1 through other_origin (translate.google.com). No XSS or cookies. Just standards :D

[mh-]

I seriously admire your patience in replying to comments.