This Tiny Chrome Behavior Leads to an Account Takeover

Keypoints :

• A single image tag can be exploited to hijack user sessions by manipulating browser referral headers.
• Browsers normally restrict leaking full URLs across domains using the referral policy, but setting it to ‘unsafe URL’ can bypass these protections.
• OAuth workflows often send sensitive tokens and data via URL query parameters, which can be leaked through manipulated referral headers.
• Attackers can abuse trusted resources and embed malicious headers to force browsers to leak full URLs, including tokens.
• A demo shows how to set up a web server that serves a minimal image with a modified referral policy header to facilitate session hijacking.
• By intercepting OAuth redirect URLs and injecting malicious image tags, an attacker can steal authorization codes and hijack accounts.
• This vulnerability emphasizes the importance of proper URL handling and browser security policies to prevent session hijacking attacks.