# Using Hackability to uncover a Chrome infoleak

Chrome's baseURI on an about:blank subframe leaked the cross-origin parent URL, letting a framed page read OAuth tokens from another subdomain.

- Payout: $2,000
- Severity: medium
- Program: Google
- Credited: Gareth Heyes
- Disclosed: 2022-09-01
- Write-up quality: 7/10
- Original: https://portswigger.net/research/using-hackability-to-uncover-a-chrome-infoleak
- Library page: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-using-hackability-to-uncover-a-chrome-infoleak
- Tags: domain:browser impact:data-leak kind:research platform:research sev:medium tech:chromium technique:chained technique:js-analysis technique:source-review vuln:info-disclosure

**Target:** Chromium Document.baseURI property on about:blank subframes
**Root cause:** Document::BaseURL() incorrectly returns ParentDocument()->BaseURL() for about:blank frames (known TODO since crbug.com/751329), so baseURI reflects the cross-origin parent URL instead of about:blank.
**Steps:**
1. Embed a cross-origin page that itself contains an iframe inside an attacker iframe.
2. From attacker JS set `x.contentWindow[0].location='about:blank'`.
3. Read `x.contentWindow[0].document.baseURI` — it returns the cross-origin parent's full URL including query/hash.
4. Repeat with modified query/hash to confirm live leakage of cross-domain URL data.
**How found:** An Academy dangling-markup lab stopped working; investigating why led to enumerating properties exposed after setting a cross-domain subframe to about:blank using the Hackability Inspector, then filtering for URL-bearing properties like document.URL and baseURI.
**Exploitation:** Attacker page frames a victim page (e.g. oauth.example.com) that contains at least one iframe; setting the subframe location to about:blank then reading baseURI yields the victim's full URL, exposing OAuth tokens or sensitive query parameters to a different subdomain.
**Escalation:** Chained with dangling markup injection / CSP bypass technique to reach frameable cross-origin pages and exfiltrate OAuth tokens.
**Insight:** When a frame is navigated to about:blank, enumerate URL-bearing properties (baseURI, documentURI, referrer) on the cross-origin window — inherited parent-document state can leak the full cross-origin URL including query and hash.