Hacker News Reader

Was. It's fixed now, apparently ;)

Remember when YouTube had a similar issue with <script> tags executing from within comments?

It wasn't quite that simple ;-)

http://www.reddit.com/r/programming/comments/cluc5/html_inje...

The payload in the case of YouTube was only slightly more complex (two <script> tags instead of one), but it sounds like the underlying cause was very different.

---

Many websites and web applications are vulnerable to XSS in one form or another. The difference here, as people have pointed out, is the trust placed in the site by Android. It's not very often that an XSS vulnerability can execute arbitrary code on a remote system. :-P

I think the underlying cause was the same - unescaped output that was supplied by the (malicious) user.

Mmm, from here it looks like YouTube had a sanitizer in place that failed: it's not clear that the Android Market was sanitizing the output here. That's what I meant by the underlying cause being different.

Someone at Google probably got in trouble over this.