The same-origin policy is the boundary that makes the web safe to use: content loaded from one origin must not be able to read the properties of another. Rafay’s research repeatedly demonstrated where that boundary broke down in practice, most notably in CVE-2014-6041, a same-origin policy bypass in the Android Open Source Project browser. Google initially rejected the report; it was accepted after researchers at Rapid7 independently verified it, and Trend Micro later found the issue to be more widespread than first understood. The episode contributed to Google re-architecting WebView as a component updatable independently of the Android version.
A parallel line of work covered address bar spoofing: making a browser display one origin while serving content from another. In 2018 he disclosed spoofing vulnerabilities in both Apple Safari and Microsoft Edge; Microsoft shipped a fix within two months, and after Apple did not respond within the 90-day window, the research was published. In October 2020, in a disclosure coordinated by Rapid7, he unveiled address bar spoofing vulnerabilities affecting Safari, Yandex, Opera Mini, Opera Touch, UC Browser, Bolt and RITS — covered by TechCrunch, The Register, BBC, Forbes and The Daily Swig.
The methodology behind this work was presented at Black Hat Asia in Bypassing Browser Security Policies For Fun And Profit. The through-line is consistent: as memory corruption became harder to exploit, vulnerability classes that attack trust and identity — same-origin policy bypass, universal XSS, spoofing and cross-file attacks — became the more practical route to compromise.
A selection of publicly documented vulnerability disclosures, each independently reported in mainstream and industry press.
| Year | Target | Class | Outcome |
|---|---|---|---|
| 2014 | Android Browser (AOSP) < 4.4 | Same-origin policy bypass (CVE-2014-6041) | Verified via Rapid7; contributed to Google re-architecting WebView |
| 2014–15 | Android WebView | Local file read, cookie theft | Contributions reached the Metasploit Framework with Joe Vennix |
| 2015 | Android stock browser | Address bar spoofing (CVE-2015-3830) | Proof of concept developed with Rapid7; reported via CERT/CC |
| 2016 | Chrome and Firefox for Android | Address bar spoofing (CVE-2016-5267) | Right-to-left Unicode URL flip; $5,000 in combined vendor rewards |
| 2018 | Apple Safari, Microsoft Edge | Address bar spoofing | Microsoft patched in two months; published after Apple missed the 90-day window |
| 2020 | Safari, Yandex, Opera Mini, UC, Bolt, RITS | Address bar spoofing | Coordinated by Rapid7 on a 60-day timeline; PoCs released after expiry |
| 2024 | PureVPN Linux client | Multiple vulnerabilities | Joint research; covered by The Independent |
Compiled from public disclosures and press coverage. See the advisories index for the current record.
Two practitioner texts published by Taylor & Francis, used in university courses and professional training worldwide.
| Title | Publisher | Year | ISBN |
|---|---|---|---|
| Ethical Hacking and Penetration Testing Guide | Auerbach Publications / Taylor & Francis | 2014 | 978-1-4822-3161-8 |
| Web Hacking Arsenal: A Practical Guide to Modern Web Pentesting | CRC Press / Taylor & Francis | 2024 | 978-1-032-44719-3 |
Full publication list, including research papers, is on our publications page.
Alongside vulnerability research, Rafay has contributed to national-level cyber security policy as Senior Consultant for Cyber Security at the Pakistan Telecommunication Authority, the country’s national telecom regulator.
| Work | Body | Role |
|---|---|---|
| Cyber Security Strategy for Telecom Sector 2023–2028 | Pakistan Telecommunication Authority | Named contributor on the authoring team, credited as Senior Consultant Cybersecurity |
| National Cyber Security Framework for Telecom Sector | Pakistan Telecommunication Authority | Contributor to the formulation of the framework |
| Cyber security regulations | Pakistan Telecommunication Authority | Enhancement of sector cyber security regulations |
| Telecom sector audit criteria | Pakistan Telecommunication Authority | Formulation of audit criteria for the sector |
| Social media regulation case (2021) | Islamabad High Court | Appointed amicus curiae to advise the court |
The telecom strategy is published by the PTA and names the authoring team.
Awards, listings and public appointments, each independently documented.
Selected international conferences where this research has been presented.
Research by Rafay and his collaborators has been reported by BBC News, Forbes, TechCrunch, The Register, Engadget, Threatpost, SC Media, The Daily Swig, AppleInsider, IT Pro, South China Morning Post and Hindustan Times, among others.
He is regularly approached for comment and analysis on browser security, mobile privacy, deepfakes and disclosure policy by national and international outlets including the Wall Street Journal, The Independent, Dawn and The Express Tribune.
He has written on security at rafaybaloch.com since 2011, where much of the browser research above was first published alongside full disclosure timelines.
The browser spent twenty-five years building the same-origin policy because separating origins is what makes it safe to render untrusted content. AI browsing agents largely dissolve that separation: content retrieved from a web page, a document, an email and a search result is flattened into a single context window, and the model has no reliable notion of which origin any instruction came from.
That makes indirect prompt injection a direct descendant of the vulnerability classes above. Where a same-origin policy bypass let content from one origin read another’s data, an injected instruction can now cause an agent, already authenticated as the user, to act against a second origin on an attacker’s behalf. Where address bar spoofing misled a user about an origin, agent interfaces frequently present no origin information at all.
This is the focus of current research at RedSecLabs, and it underpins our AI and LLM penetration testing methodology. Findings are handled under coordinated disclosure with the relevant vendors before publication.
Where Rafay works directly with clients and leads methodology development at RedSecLabs.
The methodology behind our published research is the same methodology we bring to client engagements.