Hackers Exploit HTTP/2 Flaw to Launch Arbitrary Cross-Site Scripting Attacks

Researchers have uncovered critical vulnerabilities in HTTP/2 server push and Signed HTTP Exchange (SXG) that allow attackers to bypass the Same-Origin Policy (SOP). These flaws enable off-path attacks.