bencteux.frwriteupBypassing Chrome's URL restrictions
The author examines Chrome's pre-89 defense that blocks outbound requests to http/https URLs containing both '<' and newline characters, a mitigation against HTML dangling-markup/XSS exfiltration. He shows the restriction only applied to http/https and demonstrates bypassing it by exfiltrating HTML content via a dangling `<meta http-equiv="refresh">` tag pointed at an `ftp://` URL, captured with a netcat FTP listener. The bug was reported to Chromium, which responded by dropping FTP and Gopher scheme support in Chrome 89, killing the bypass.
TL;DR Chrome blocked URLs with '<'+newline to stop dangling-markup XSS exfiltration over http/https, but switching to ftp:// bypassed it — until Chrome 89 dropped FTP/Gopher entirely.
Organisations named here
- dangling markup injection
Technologies named here
- Netcat
- Google Chrome
- book.hacktricks.xyz
- Chrome
Standards and laws named here
- Content Security Policy
Techniques named here
- HTML dangling markup injection
- Chrome URL restriction bypass via alternate schemes
- Base64 encoding data before exfiltration
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup