EXPLOITING SELF-XSS USING DISK CACHE

Summary from the TLDR InfoSec newsletter

Security researchers have developed a novel technique to exploit self-XSS vulnerabilities by combining login CSRF attacks with browser disk cache manipulation. The attack works by forcing victims to log into attacker-controlled accounts, then using browser history navigation (`history.go(-2)`) to access cached victim data from previous sessions. Organizations can defend against this attack vector by implementing `Cache-Control: no-store` headers on sensitive endpoints to prevent disk cache exploitation.