localghost: Escaping the Browser Sandbox
Explores browser sandbox architecture and demonstrates localghost techniques for escaping client-side sandboxes.
Summary
Application security researcher Parsia Hakimian presents "localghost" in the AppSec Village, exploring how malicious websites can escape browser security sandboxes to exploit local web and WebSocket servers running on client machines [00:14, 07:33].
Hakimian analyzes desktop software—including Electron applications, developer tools, and system agents—that bind background HTTP or WebSocket servers to localhost to support user interfaces [21:50]. Because the browser Same-Origin Policy (SOP) does not restrict WebSocket handshakes, he demonstrates how an untrusted public website visited in a browser can establish unauthorized WebSocket connections to local ports, allowing remote attackers to achieve remote code execution [14:48]. The session reviews mitigation techniques, emphasizing the strict validation of browser Origin headers and the enforcement of explicit authentication tokens on all local listening services [29:18, 36:40].
(AI summary — Gemini Flash)
Related talks
Main Stage·40 min
Dongsung Kim
Dongsung Kim demonstrates how modern browser features and emerging Web APIs can be chained to resurrect Cross-Site Request Forgery (CSRF) despite SameSite cookies.
App Sec Village·27 min
Avi Lumelsky · Gal Elbaz
Unveils the 0.0.0.0-day vulnerability in major browsers that lets public websites pivot to internal localhost APIs and achieve RCE.
App Sec Village·48 min
Mehmet D. Ince
Analyzes flaws in web security controls and demonstrates exploitation methods that bypass common defensive boundaries.