# Clickjacking on Google MyAccount Worth 7,500$

CSP on myaccount.google.com reflected the origin param; injecting %0d before business.google.com dropped the frame-ancestors CSP, enabling clickjacking to hijack a Google brand account group.

- Payout: $7,500
- Severity: medium
- Program: Google
- Credited: apapedulimu / Nosa Shandy
- Disclosed: 2018-11-11
- Write-up quality: 6/10
- Original: https://apapedulimu.click/clickjacking-on-google-myaccount-worth-7500/
- Library page: https://bugbountylibrary.com/r/blog%3Aapapedulimu-click-clickjacking-on-google-myaccount-worth-7500
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:blog sev:medium technique:param-pollution vuln:clickjacking vuln:crlf-injection vuln:misconfiguration

**Target:** myaccount.google.com brandaccounts managers page
**Root cause:** The CSP frame-ancestors directive was built from the user-controlled origin query parameter, and inserting a URL-encoded CR (%0d) before the host caused the CSP header to be dropped entirely.
**Steps:**
1. Visit https://myaccount.google.com/u/0/brandaccounts/group/{group-id}/managers?originProduct=AC&origin=https://business.google.com and observe CSP frame-ancestors reflecting the origin param.
2. Modify origin to https://%0d.business.google.com.
3. Observe the CSP header disappears from the response.
4. Embed the URL in an iframe: `<iframe src="https://myaccount.google.com/u/0/brandaccounts/group/{group-id}/managers?originProduct=AC&origin=https://%0d.business.google.com" width="1000" height="1000">`.
5. Trick an admin into clicking to promote the attacker's account to owner.
**How found:** While exploring business.google.com, noticed redirect to myaccount.google.com lacked X-Frame-Options; initial iframe PoC was blocked by CSP on modern browsers. Later re-examined and noticed the CSP rule was reflected from the origin request parameter, which only accepted business.google.com. Tried a subdomain (accepted but unusable), then added a URL-encoded illegal character (%0d) before the host, which made the CSP disappear.
**Exploitation:** Attacker (a newly invited group member who knows the group-id) hosts a malicious page iframing the CSP-bypassed managers URL and overlays/positions it so the admin's clicks promote the attacker to group owner, taking over the brand account group.
**Escalation:** Clickjacking a privileged admin action (promote to owner) escalates a low-privilege invited member to full group takeover.
**Insight:** When a security header (CSP, frame-ancestors) is reflected from a request parameter, fuzz the parameter with encoded control characters (CR/LF, null, tabs) — a malformed value can cause the header to be dropped rather than rejected, silently removing protection.