# CVE-2022-4908: SOP bypass in Chrome using Navigation API

Chrome's Navigation API leaked cross-origin history entries after navigating a same-site window to about:blank, enabling OAuth code/token theft and account takeover.

- Payout: unconfirmed
- Severity: high
- Program: Google
- Credited: Johan Carlsson
- Disclosed: 2023-10-06
- CVE: CVE-2022-4908
- Write-up quality: 8/10
- Original: https://joaxcar.com/blog/2023/10/06/cve-2022-4908-sop-bypass-in-chrome-using-navigation-api/
- Library page: https://bugbountylibrary.com/r/blog%3Ajoaxcar-com-blog-2023-10-06-cve-2022-4908-sop-bypass-in-chrome-using-navigation-api
- Tags: domain:browser impact:ato impact:data-leak kind:bounty platform:blog sev:high tech:chromium technique:chained technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Chromium Navigation API (navigation.entries()) in browser
**Root cause:** When navigating a cross-origin-but-same-site window to about:blank, Chrome copied the previous NavigationApi object (including its history entries) instead of consulting the browser process, so the new about:blank document could read the prior origin's full URL history.
**Steps:**
1. Attacker page opens/frames a same-site cross-origin target window (e.g. `open('https://accounts.google.com/...')` or iframe).
2. Attacker sets `target.location='about:blank'` to hijack the window.
3. Attacker reads `target.navigation.entries()[0].url` to obtain the full prior URL including query/fragment.
4. Parse leaked URL for `code`, `id_token`, or `access_token` from OAuth redirect.
5. Replay leaked `code`/`state` at `https://codesandbox.io/auth/google/callback?state=...&code=...` to log in as victim.
6. Optionally call `target.history.back()` to restore the window and poll repeatedly as a history logger.
**How found:** Inspired by Gareth Heyes' baseURI infoleak writeup; used Hackability Inspector to search window properties but realized the tool only checks static properties, not method return values. Recalled the Navigation API's entries() method and tested calling it on a hijacked about:blank iframe, discovering it returned the prior origin's history.
**Exploitation:** Attacker hosts payload on a user-content subdomain that is same-site but not same-origin with the target (e.g. mytestapp.codesandbox.io vs codesandbox.io). Opens the victim's OAuth flow in a new window, waits, navigates it to about:blank, reads navigation.entries() to extract the OAuth code/token from the redirect URL fragment, then submits the stolen code to the target's callback to authenticate as the victim.
**Escalation:** Chained a same-site subdomain XSS/user-content foothold with the SOP bypass and Frans Rosen's OAuth 'dirty dancing' technique to escalate a URL leak into full account takeover.
**Insight:** Property-scanning tools miss leaks returned by method invocation; when auditing a new browser API, enumerate methods whose return values are computed at call time (like entries()) and test them after about:blank hijacks, especially same-site cross-origin cases where process swaps don't occur.