Later archive addition

Stealing oAuth Token via Referrer Policy Override

Omid Rezaei · Voorivex · 6 May 2025

Turns a limited image injection into OAuth-code leakage by controlling the image response. A Link preload header specifies unsafe-url referrer policy, causing the documented Chrome behavior to disclose the embedding page’s query URL to the attacker; an application testbed demonstrates the required redirect and subresource conditions.

Record

Researcher

Omid Rezaei

Published by

Voorivex

Date

6 May 2025

In the archive

• Added to the 2025 archive after the original list was published

Related sources

• Testbed
• Chromium Link-header behavior discussion
• Referrer override practice application

Tags

• oauth
• header-injection
• info-leak
• attack-chain
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Omid Rezaei, first published at the original source. Preserved copies are kept so the citation survives its host.