Browser security is still a work in progress, and a pair of new attacks is putting more pressure on already-strained defenses: one hacks protections against cross-site request forgery (CSRF), and ...