3 ms·
You can also get browser history by misusing CSP violation reports.
by joshfraser 10y ago
You can also get browser history by misusing CSP violation reports.
- captn3m0 10y agoIt has since been fixed since Chrome 48, it seems. Not sure about other browsers. The attack is pretty interesting btw: pinning CSP to http-only, which means that the block can be timed to reveal whether the URL was in history. the fix was just dis-allowing CSP to restrict to http.