# AppCache's forgotten tales

Chrome AppCache NETWORK section allowlist plus non-standard isPattern glob matching let a malicious page brute-force cross-origin redirect URLs char-by-char, leaking CSRF tokens and usernames.

- Payout: $10,000
- Severity: medium
- Program: Google
- Credited: Luan Herrera
- Disclosed: 2021-05-31
- CVE: CVE-2020-6399, CVE-2021-21168
- Write-up quality: 8/10
- Original: https://blog.lbherrera.me/posts/appcache-forgotten-tales/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-lbherrera-me-posts-appcache-forgotten-tales
- Tags: domain:browser impact:data-leak impact:pii-leak kind:bounty platform:blog sev:medium tech:chromium technique:recon technique:source-review vuln:info-disclosure vuln:xs-leak

**Target:** Chrome AppCache manifest NETWORK section / cross-origin redirects
**Root cause:** AppCache NETWORK section acts as an allowlist that also applies to redirect targets, and Chrome's non-standard isPattern glob matching plus prefix-based URL matching let attackers test whether a redirect URL matches a guessed pattern, turning fetch success/failure into an oracle.
**Steps:**
1. Host page with `<html manifest="cache.manifest">` and script fetching target with `{mode:'no-cors', credentials:'include'}`.
2. Manifest lists target endpoint plus guessed pattern entries like `https://facebook.com/v* isPattern` in NETWORK section.
3. Fetch `/me`; if redirect target matches an allowlisted pattern the promise resolves, else rejects with network error.
4. Binary-search charset by including half the characters as patterns per manifest, narrowing until full redirect URL is recovered.
5. For rotating tokens, fetch endpoint with `cache:'force-cache'` to freeze the Location header before brute-forcing.
**How found:** Prior XSLeak research showed Cache section could detect redirects; testing NETWORK section revealed it acts as an allowlist even for redirect targets; reading Chrome AppCache source surfaced 'URL patterns'/'not standardized' keywords leading to issue 224426 and the isPattern glob feature.
**Exploitation:** Attacker lures victim to malicious page; manifest installs and restricts network to allowlisted entries; fetch to a redirecting endpoint reveals via resolve/reject whether the redirect target matches guessed patterns; binary search recovers full URL including CSRF token or username.
**Escalation:** Chained cache freezing via force-cache to defeat token rotation, and later abused spec prefix-matching to re-enable the attack after the first fix.
**Insight:** When a browser feature implements a non-standard extension (isPattern globs) on top of an allowlist that also governs redirect targets, the allowlist becomes a per-character oracle; grep browser source for 'not standardized' comments to find such deviations.