Writeups

OAuth redirects https://notebooks.cloud.google.com/static/oauth.html and https://developerconnect.google.com/redirect appear to preform no protocol checks allowing for network attackers to leak tokens.
It’s a less cool https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.1 variant of https://bughunters.google.com/reports/vrp/wG2bN8vZr for network attackers.

const ALLOWED_ORIGINS = [
  'codeassist.google.com',
  'pantheon.corp.google.com',
  'pantheon-staging.corp.google.com',
  'pantheon-staging-sso.corp.google.com',
  'pantheon-hourly.corp.google.com',
  'pantheon-hourly-sso.corp.google.com',
  'console.cloud.google.com',
  'code-assist-free-tier.corp.google.com',
  'code-assist-free-tier-autopush.corp.google.com',
  'code-assist-free-tier-staging.corp.google.com',
  'localhost.corp.google.com:9998'
];
let origin = JSON.parse(
  new URLSearchParams(window.location.search).get('state')
).origin;
let host = new URL(origin).hostname;
for (const allowedOrigin of ALLOWED_ORIGINS) {
  if (host.endsWith(allowedOrigin)) {
    window.opener.postMessage(window.location.toString(), origin);
    window.close();
    break;
  }
}

Requirements:

User steps:

Attacker script steps:

Reasoning for WONTFIX

“We’ve reviewed your report, and it seems the attack you’ve outlined relies on a few unlikely conditions. For this to work, a user would need to be on a malicious network and then actively click through redirects to an attacker-controlled site. We’re also not clear on how a user would initially be directed to this malicious website.

Given these factors, we won’t be tracking this as a security vulnerability.”

The Chromium team are planning on enabling HTTPS by default for Chrome 154 in October 2026 https://security.googleblog.com/2025/10/https-by-default.html

Time line

Improve this page