---
id: 5465
title: "Using Hackability to uncover a Chrome infoleak"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/using-hackability-to-uncover-a-chrome-infoleak"
published_at: "2022-09-01T13:32:00Z"
tags: ["browser-security", "chrome", "same-origin-policy", "information-leak", "hackability", "oauth-tokens"]
phying_url: "https://phying.com/item/5465"
lang: en
---

# Using Hackability to uncover a Chrome infoleak

## Summary

Using his Hackability Inspector, Gareth Heyes found a Chrome infoleak: setting a cross-domain iframe to about:blank exposed baseURI, leaking full URLs and enabling OAuth token theft across subdomains.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-09-01T13:32:00Z
- **Original:** https://portswigger.net/research/using-hackability-to-uncover-a-chrome-infoleak
- **Phying News:** https://phying.com/item/5465