Other nomination

CVE-2022-4908: SOP bypass in Chrome using Navigation API

Johan Carlsson and @joaxcar · Johan Carlsson · 6 October 2023

Chrome's Navigation API copied navigation.entries() from the previous document when a window or frame was navigated to about:blank, so a same-site but cross-origin page could read the target window's full history URLs (CVE-2022-4908). Combined with broken OAuth flows this exfiltrates codes and tokens, turning a subdomain XSS or takeover into account takeover.

Record

Researcher

Johan Carlsson and @joaxcar

Published by

Johan Carlsson

Date

6 October 2023

Format

Advisory

In the archive

• Nominated for the 2023 Top 10 Web Hacking Techniques

Tags

• sop-bypass
• same-origin-policy
• info-leak
• oauth
• cve
• iframe
• javascript
• attack-chain
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Johan Carlsson and @joaxcar, first published at the original source. Preserved copies are kept so the citation survives its host.