Attacks in HTML5

Now days, a web user can enjoy chatting, playing games and Internet banking from simple structured text. The browsers have changed from being a simple structured display to supporting complex multimedia application. All these applications have something in common, they can be run on different platforms and in some cases they will run offline. This is possible due to new features in latest specification HTML, specifically, drawing featured canvas. In this paper, after providing some background to HTML5, we are going to discuss attack surface and possible threats. - CSRF and leveraging CORS to bypass SOP - Attacking WebSQL and client side SQL injection - ClickJacking & Phishing by mixing layers and iframe - Stealing information from Storage and Global variables - DOM injections and Hijacking with HTML 5