# Site Isolation bypass via Chrome extension

Google Input Tools extension background script allowed a compromised renderer to send credentialed POST requests to arbitrary origins and read responses, bypassing Site Isolation.

- Payout: $3,134
- Severity: high
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2019-11-27
- Write-up quality: 7/10
- Original: https://lf.lc/vrp/145304705/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-145304705
- Tags: domain:browser impact:data-leak impact:internal-access kind:bounty platform:blog sev:high tech:chromium technique:chained technique:source-review vuln:auth-bypass vuln:cors

**Target:** Chrome extension background script (chext_backgroundpage.js) message handler
**Root cause:** The extension's background script accepted a message with a URL and headers from any content script and performed a credentialed cross-origin POST on its behalf, returning the response body to the renderer.
**Steps:**
1. Install Google Input Tools extension (v5.9.0.0) in Chrome 78.
2. Visit an attacker origin and open DevTools.
3. Select the Google Input Tools content script in the scope dropdown to simulate renderer compromise.
4. Execute `chrome.runtime.sendMessage({sq:true, url:"@mail.google.com/mail/u/0/", hd:{"x-arbitrary":"header"}}, cb)` from the content script.
5. Observe the cross-origin response logged via the callback.
**How found:** Researcher examined the extension's background script message handler and noticed it accepted arbitrary URL and headers from content scripts, then tested cross-origin credentialed POST with response readback.
**Exploitation:** A renderer-compromise attacker sends a crafted message to the extension background page; the extension issues a POST to the target HTTPS origin with attacker-controlled headers and default cookies, then returns the response to the renderer, defeating Site Isolation.
**Insight:** Extensions that proxy fetch/XHR on behalf of content scripts are a Site Isolation bypass primitive: audit background-script message handlers for attacker-controlled URL, method, headers, and response return, especially where cookies are sent by default.