Thomas Orlita

Posts

• Overriding Bitwarden's Chrome autofill integration to enable Google Pay 2026-09-23
• What I want to want 2026-07-28
• HTTP header easter egg 2026-06-04
• A guy with a rifle in my hotel room 2026-05-04
• The Too Good To Go experiment 2026-01-21
• chrome://crash is the best home page 2025-11-27
• view all posts →

Projects

• Street View Download 360 Software for downloading 360° panoramas from Google Street View.
• Czengland Explore the map of Czechia reimagined as if the English got here first.
• CrFuzz A framework for automated memory vulnerability detection in web browsers.
• img.onl A fast and easy way to share images anywhere.
• Transform Tool Lightweight tool for transforming data with JavaScript in the browser.
• Realtime Collaborative Board Online web platform with many realtime tools.
• view all projects →

Web security

• Blind XSS in an internal Google Service via the Server header websecblog.com
• 5 different vulnerabilities in Google’s Threadit websecblog.com
• Clickjacking DOM XSS on Google.org websecblog.com
• XSSing Google employees: blind XSS on googleplex.com websecblog.com
• Inserting arbitrary files into anyone’s Google Earth Studio projects archive websecblog.com
• Bypassing Firebase authorization to create custom app.goo.gl subdomains websecblog.com
• view all posts →

Contact