# The unexpected Google wide domain check bypass

Google Closure Library's URL authority regex didn't treat backslash as authority terminator, unlike browsers, letting attackers bypass domain whitelists and steal API keys via postMessage.

- Payout: $6,000
- Severity: high
- Program: Google
- Credited: David Schütz
- Disclosed: 2020-03-08
- Write-up quality: 9/10
- Original: https://bugs.xdavidhu.me/google/2020/03/08/the-unexpected-google-wide-domain-check-bypass/
- Library page: https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2020-03-08-the-unexpected-google-wide-domain-check-bypass
- Tags: domain:web impact:data-leak kind:bounty platform:blog sev:high technique:fuzzing technique:parser-differential technique:source-review vuln:access-control vuln:info-disclosure

**Target:** Google Closure Library goog.uri.utils split regex / henhouse iframe postMessage
**Root cause:** The Closure Library URL-parsing regex only terminates the authority on /, ?, #, while browsers also treat backslash as an authority terminator, creating a parser differential.
**Steps:**
1. Fuzz URL authority terminators: loop chars in `https://xdavidhu.me<CHAR>.corp.google.com` through `new URL()`
2. Observe `\` yields hostname `xdavidhu.me` in browser
3. Confirm regex `magicRegex.match(url)[3]` returns `xdavidhu.me\test.corp.google.com` (ends with `.corp.google.com`)
4. Embed henhouse iframe with pb[4]=`https://xdavidhu.me\test.corp.google.com`
5. Listen for postMessage and capture `apikey-credential` data
**How found:** Noticed henhouse iframe postMessages API keys to pb[4] domain; whitelist bypass failed, so reverse-engineered obfuscated JS to find the authority regex; hypothesized a char that ends authority in browser but not regex; wrote a JS fuzzer over all printable chars and found backslash.
**Exploitation:** Attacker hosts malicious page embedding the henhouse iframe with a pb[4] URL whose regex-parsed authority ends in .corp.google.com but whose browser authority is attacker domain; victim generates API key, which is postMessaged to attacker origin.
**Escalation:** Same regex found across Google Cloud Console, Actions Console, YouTube Studio, myaccount.google.com, Android apps, and corp login page, widening impact beyond henhouse.
**Insight:** When a target validates URLs with a hand-rolled regex, fuzz every printable character as an authority terminator against the real browser URL parser to find parser differentials; then grep the regex across other products to gauge blast radius.