hackideiomat

This android wallet has an internal browser and it incorrectly strips www. from hosts. This also affects their permission system, meaning this is the perfect bug to phish users.

They didn't answer multiple mails in 30 days, so it's being disclosed.

Don't get me wrong, I do use kagi. but it's not nearly what I wish it'd be.

Maybe MetaGer if you can live with their quality

Oh yes because of the CSP. The CSP that allows forms that can change your settings... you could easily use the above bug to get some impact with an additional click on a form's submit button.

Admittedly, no full XSS anymore, but still dangerous and shows their lack of understanding and caring about security.

It's not the only place you can inject HTML and not every page has a CSP...

Go look at MetaGer, they solved that issue

They do not take security and privacy seriously

I don't want that?

Well if you attack his friends, it's not okay, but if you go which death upon 'the leftists' he wouldn't say a thing, I bet

Dude can move so many millions around I'd shit my pants if he tells me to die slow.

oh man I didn't know I'd hate this guy :D

There's another tool like this called horcrux, which I find to be a better name personally.

=cmd|' /C calc'!A0