Cross-Site WebSocket Hijacking Exploitation in 2025

Include Security's latest blog post covers Cross-Site WebSocket Hijacking and how modern browser security features do (or don't) protect users. We discuss Total Cookie Protection in Firefox, Private Network Access in Chrome, and review the SameSite attribute's role in CSWH attacks. The post includes a few brief case studies based on situations encountered during real world testing, in addition to a simple test site that can be hosted by readers to explore each of the vulnerability conditions.

The post Cross-Site WebSocket Hijacking Exploitation in 2025 appeared first on Include Security Research Blog.