Render-Based Data Exfiltration
An attack technique in which an attacker induces a victim client's rendering engine to issue network requests carrying sensitive information while parsing malicious content. Common vectors include img tags, CSS url(), link preloading, and Markdown image syntax. Because the requests originate from a trusted application, they often bypass the same-origin policy and conventional firewalls.
Timeline (last 90 days)
Rendering-based data exfiltration refers to an attacker inducing the victim's client-side rendering engine to actively initiate network requests carrying sensitive information when parsing malicious content, with common vectors including <img src>, CSS url(), <link> preloading, and Markdown image syntax, and the core of defense being Content Security Policy (CSP).
Rendering-based data exfiltration attacks the presentation layer, while prompt injection attacks the model's decision layer; the two can be stacked to form a composite attack chain.
All Facts (2)
Rendering-based data exfiltration refers to an attacker inducing the victim's client-side rendering engine to actively initiate network requests carrying sensitive information when parsing malicious content, with common vectors including <img src>, CSS url(), <link> preloading, and Markdown image syntax, and the core of defense being Content Security Policy (CSP).
50%UnverifiedRendering-based data exfiltration attacks the presentation layer, while prompt injection attacks the model's decision layer; the two can be stacked to form a composite attack chain.
50%