3 ms·
It has since been fixed since Chrome 48, it seems. Not sure about other browsers. The attack is pretty interesting btw: pinning CSP to http-only, which means th
by captn3m0 10y ago
It has since been fixed since Chrome 48, it seems. Not sure about other browsers. The attack is pretty interesting btw: pinning CSP to http-only, which means that the block can be timed to reveal whether the URL was in history.
the fix was just dis-allowing CSP to restrict to http.