Chrome Omnibox URL Bar Phishing via 304 Status Code Spoofing

Vulnerability Key Information Vulnerability Details Description: - By entering a URL in the address bar that triggers a 304 status code response and then pressing Enter, the page does not load, but the URL remains in the address bar. The event can be used to detect the moment the user presses Enter. Attackers can exploit this to create a malicious site that appears to be a legitimate login page. Versions: - Chrome Version: 69.0.3497.81 (Official Build) (64-bit) (Stable) - Operating System: macOS 10.13.6 Reproduction Example: - A simple example file is provided, which fakes a request to the domain. Any website returning a 304 status code may be vulnerable. - Test link: httpstat.us Test Site. - Other redirect status codes (such as 301, 302, etc.) may also be affected. Additional Information Priority: P2 Severity: S3 Status: Fixed Reporter: je...@gmail.com Owner: mm...@chromium.org Component: Chromium > UI > Browser > Omnibox Labels: - Fixed - Vulnerability - P2 - Security_Impact-Stable - reward-inprocess - CVE_description-submitted Report Date: September 10, 2018 Discussion The reporter noted that in other browsers, the target domain usually loads but displays a blank page. If this behavior is considered normal and obvious, the issue is less severe. The reporter is unsure whether this issue occurs only in the stable version or has been inadvertently fixed. Omnibox and navigation experts have been added to the watch list for further confirmation and handling.

Goal Reached Thanks to every supporter — we hit 100%!

Chrome Omnibox URL Bar Phishing via 304 Status Code Spoofing