Six of eight SVG sanitizers failed PortSwigger's tests — browser parsing makes upload safety harder
Six of eight SVG sanitizers in a PortSwigger test had bypasses; developers must review SVG upload and rendering contexts, CSP and library versions.
Search
Search results for “browser parsing differences”
Find published research by company, product, platform or technology.
Showing 1–20 of 117 dossiers
Artificial IntelligenceWeb DevelopmentAI AgentsWordPressBrowsers & Web StandardsDeveloper ToolsActive dossier
WebMCP gives websites a structured tool layer for browser agents
WebMCP is no longer a Chrome-only browser experiment: Microsoft Edge now has its own active origin trial, while ChatGPT’s built-in browser and WordPress Playground show agent-client and platform implementation paths.
Artificial IntelligenceWeb DevelopmentAI CodingBrowsers & Web StandardsDeveloper ToolsActive dossier
Safari 27 gives coding agents a local MCP path into live browser debugging
WebKit's Safari MCP server is available in stable Safari 27.0 as well as Technology Preview. It runs locally, but captured page data passes to the connected agent; remote automation must be enabled explicitly.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsDeployment & DevOpsDeveloper ToolsActive dossier
Lightpanda 1.0 makes a Zig headless browser production-ready for agents and crawlers
The browser-for-machines project has reached 1.0 with a major web-compatibility jump and new cross-origin protections. It is not a drop-in replacement for every Chrome use case.
Artificial IntelligenceWeb DevelopmentCloud & InfrastructureAI AgentsCloud PlatformsDeveloper ToolsActive dossier
Cloudflare Browser Run can now hard-limit agent sessions to approved hostnames
The useful change is containment rather than another browser-agent feature. Teams can let an agent operate a real browser while constraining its HTTP and HTTPS reach to the site and dependencies the task actually needs, reducing the blast radius of prompt injection, bad tool decisions or untrusted page content.
Artificial IntelligenceWeb DevelopmentBrowsers & Web StandardsInference & APIsDeveloper ToolsActive dossier
SwarmLLM splits a 27B model across browser tabs with WebGPU and WebRTC
SwarmLLM does not route whole prompts to separate machines; it pipelines one model across browser tabs. A MacBook and iPhone can jointly hold Qwen 3.8 27B even when neither device can hold the full 15GB quantized model alone, with no inference server in the loop.
Hugging Face releases 207 versioned WebGPU kernels for browser AI
Hugging Face has released 207 Apache-2.0 WebGPU kernels, a JavaScript loader and Fleet, a browser benchmarking service. The package makes kernel contracts and correctness evidence inspectable, but performance remains device- and workload-dependent.
WordPress Playground can now boot WordPress 0.7 through 6.2 in the browser
Playground’s legacy-runtime work turns the browser sandbox into a version-spanning compatibility lab. Maintainers can inspect old WordPress behavior without keeping obsolete PHP stacks alive, although the browser runtime is not a faithful recreation of every historical host.
Eight eMudhra CA keys compromised: browsers block forged TLS chains as operators face certificate migration
eMudhra is leaving global TLS certificate issuance after its weak-key incident. Existing certificates and custom trust stores still require audit and migration; Indian DSC and eSign operations are not part of the announced exit.
Chrome 155 enables JPEG XL by default, moving the format toward mainstream web delivery
JPEG XL now ships by default in Chrome 155 and Firefox 158; Safari supports still images, but Edge, installed-version lag and format tooling still warrant fallback delivery.
Firefox Enterprise 158 puts browser policy, data controls and AI governance on customer-run infrastructure
Firefox Enterprise 158 combines a Gecko-based browser with an on-premises management console, domain-level DLP and SIEM export. Initial sales focus on four European countries; ESR support and public pricing are not yet available.
Bootstrap 6 alpha drops legacy browsers and rewrites Sass, responsive classes and JavaScript imports
A major UI framework is moving from legacy Sass and JavaScript conventions to native CSS and ESM. Existing Bootstrap 5 projects need a deliberate migration plan, not a blind version bump.
Chrome 152 lets websites put the browser behind a network allowlist
Connection Allowlists turn outbound browser networking into an explicit allowlist for Fetch and other web-platform APIs. The control is opt-in and currently Chromium-only, and strict policies can break legitimate dependencies such as FedCM identity-provider requests if teams omit required endpoints.
Agent Plugins 1.0 now has a concrete cross-client compatibility layer for Skills and MCP
Agent Plugins 1.0 now has documented support across VS Code, Cursor, GitHub Copilot, ChatGPT/Codex, Kiro and several open-source agents. That makes the format materially more useful for cross-client distribution, but portable components remain limited to Agent Skills and MCP servers while permissions, hooks, commands and host UX stay client-specific.
SaaSCloud & InfrastructureMarketing & DistributionHostingEmail & LifecycleSaaS OperationsActive dossier
Stalwart 1.0 stabilises self-hosted mail storage — but existing servers need a one-time migration
Stalwart 1.0 ships stable mail storage, new search and performance improvements; existing v0.16 installations need a migration tool, and clustered setups need Redis.
EDG opens its industrial C++ compiler front end under Apache 2.0 after three decades
The EDG front end moved from commercial licences to a public repository and C++ Alliance stewardship on September 30. A fresh October 20 statement confirms permissive commercial reuse, experienced maintainers and work still needed on reflection, coroutines and back ends.
WordPress rewrites wp_kses around the HTML API — plugin sanitisation output can change
A new HTML API-backed wp_kses() changes what sanitised HTML looks like even without an API signature change. Developers should test output-sensitive plugins before a future WordPress core release.
Dart Sass 2 will turn old warnings into build failures — maintainers publish a readiness test
Sass projects can test for upcoming Dart Sass 2 build failures now using published fatal-deprecation flags, rather than waiting for the release.
WordPress 7.1.1 closes Click2Shell’s forced-theme-install path to code execution
Click2Shell turns a theme-preview parsing bug into a supply-path problem: an attacker can force official catalog code onto a site without the administrator choosing Install, then potentially reach executable pre-activation theme code.
Google Analytics can now reject ghost traffic with hostname allowlists
Google Analytics hostname allowlists reduce some ghost-traffic cleanup, but server-side Measurement Protocol events bypass the filter. Teams must distinguish browser collection from Measurement Protocol and test empty-hostname events.