Saint SymStealer, Thief of Links

Patron of symbolic links, folders dragged into the browser without a thought, and crypto wallets.

Life

Found by Imperva and described in January 2023, he lived in Chrome's file handling. If a user dragged a folder containing a symbolic link into a page, the browser followed the link and handed over the real file, wherever it was on disk: keys, credentials, wallets.

Prayer

O Saint SymStealer, who follows links to the treasure, let our browser upload only what we chose. Amen.

How to celebrate

Celebrated by updating Chrome and eyeing suspiciously every site that asks you to drop a folder on it.

Tell me where you point, and I'll tell you what I steal.