The Curious Engineer

All blogs / Security

Frederik Braun

frederikbraun.de

Frederik Braun is a security engineer at Mozilla, working on Firefox security.

SecurityFrontend / CSS / browsersWeb development

’15’20’25
Posts
45 from 15 Jul 2013 to 31 May 2026
Posting
monthly (7 in the last year)
Kind
personal blog
Feed
https://frederikbraun.de/feeds/all.atom.xml

2026 5

  1. here to read my blog posts
  2. The S in interoperability
  3. Multiple things can be true at the same time
  4. Composing Sanitizer configurations
  5. Perfect types with `setHTML()`

2025 3

  1. Why the Sanitizer API is just setHTML()
  2. The C3PO Bug in Lego Star Wars: The Complete Saga
  3. With Carrots & Sticks - Can the browser handle web security?

2024 7

  1. Home assistant can not be secured for internet access
  2. Modern solutions against cross-site attacks
  3. Prompt Injections and a demo
  4. The Mozilla Monument in San Francisco
  5. What is mixed content?
  6. How I got a new domain name
  7. How Firefox gives special permissions to some domains

2023 3

  1. Examine Firefox Inter-Process Communication using JavaScript in 2023
  2. Origins, Sites and other Terminologies
  3. Finding and Fixing DOM-based XSS with Static Analysis

2022 2

  1. DOM Clobbering
  2. Neue Methoden für Cross-Origin Isolation: Resource, Opener & Embedding Policies mit COOP, COEP, CORP und CORB

2020 3

  1. Reference Sheet for Principals in Mozilla Code
  2. Hardening Firefox against Injection Attacks – The Technical Details
  3. Understanding Web Security Checks in Firefox (Part 1)

2019 4

  1. Help Test Firefox's built-in HTML Sanitizer to protect against UXSS bugs
  2. Remote Code Execution in Firefox beyond memory corruptions
  3. XSS in The Digital #ClimateStrike Widget
  4. Chrome switching the XSSAuditor to filter mode re-enables old attack

2017 1

  1. Challenge Write-up: Subresource Integrity in Service Workers

2016 3

  1. Finding the SqueezeBox Radio Default SSH Password
  2. New CSP directive to make Subresource Integrity mandatory (`require-sri-for`)
  3. Firefox OS apps and beyond

2015 3

  1. Teacher's Pinboard Write-up
  2. A CDN that can not XSS you: Using Subresource Integrity
  3. The Twitter Gazebo

2014 6

  1. German Firefox 1.0 ad (OCR)
  2. My thoughts on Tor appliances
  3. Subresource Integrity
  4. Revoke App Permissions on Firefox OS
  5. (Self) XSS at Mozilla's internal Phonebook
  6. Tales of Python's Encoding

2013 5

  1. On the X-Frame-Options Security Header
  2. html2dom
  3. Security Review: HTML sanitizer in Thunderbird
  4. Week 29 2013
  5. The First Post