Top 10 winner

XSS-Leak: Leaking Cross-Origin Redirects

Salvatore Abello and @salvatoreabello · Salvatore Abello's Blog · 18 September 2025

Chrome schedules equal-priority pending requests by port, then scheme, then host, so with the socket pool exhausted an attacker can race their own request against a victim page's cross-origin request and learn whether their hostname sorts before or after the target's. Binary searching that oracle leaks the subdomain of a cross-origin fetch or where a redirect lands.

Record

Researcher

Salvatore Abello and @salvatoreabello

Published by

Salvatore Abello's Blog

Date

18 September 2025

In the archive

• Ranked #8 in the 2025 Top 10 Web Hacking Techniques

Related sources

• Full exploit
• Redirect-leak demonstration application

Tags

• xsleak
• timing-attack
• side-channel
• info-leak
• csp
• http
• sop-bypass
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Salvatore Abello and @salvatoreabello, first published at the original source. Preserved copies are kept so the citation survives its host.