225 - Prompting for Secrets and Malicious Extensions

This week has an interesting mix of issues, starting with a pretty standard template inject. Then we get into a Windows desktop issue, a TOCTOU in how the Mark-of-the-Web would be applied to file extracted from an archive, a privilege escalation from a Chrome extension, and a bit of a different spin on what you could do with a prompt injection.

archive bounty-podcast chrome chrome extension desktop escalation extension extensions file inject issue malicious malicious extensions mark podcast privilege privilege escalation secrets spin standard template toctou web week windows