BSides Vancouver 2026

SameSite cookies are often relied upon too heavily to prevent cross-site request forgery, yet, due to browser implementations, they can be included in unexpected requests. This talk demonstrates novel bypass techniques, including a Chrome CVE discovered during while researching these methods. Attendees  will gain an understanding of the impacts on real-world applications, and how to protect against these attacks.