# Origin leak via navigation and window proxies

about:blank, window proxy, or native UI that copies or trusts origin state across a boundary

_Area: Memory corruption and native code. Seen in 5 disclosed reports; 2 confirmed bounties: $2,000 and $3,000; latest 2026-07-20. Updated 2026-10-23._

## How it works
A boundary that is supposed to separate origins is crossed by state that is copied, inherited, or trusted rather than recomputed. The assumption that breaks: that a new document, child window, or native widget starts with a clean origin and only sees what the browser process decides. Instead, a document inherits its parent's URL-bearing state, a window proxy carries the opener's privileges, or a privileged UI trusts geometry/origin values supplied by the renderer. The result is that one origin can read or act on another's data.

## Where it shows up
- about:blank frames/subframes whose URL properties (baseURI, documentURI, referrer) are derived from the parent document [E5](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-using-hackability-to-uncover-a-chrome-infoleak.md)
- Navigation/history APIs whose return values are computed at call time and may carry entries from a prior origin [E4](https://bugbountylibrary.com/r/blog%3Ajoaxcar-com-blog-2023-10-06-cve-2022-4908-sop-bypass-in-chrome-using-navigation-api.md)
- Framework reimplementations of window.open/eval where the opener can eval into the child [E3](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html.md)
- postMessage handlers that read origin from a query parameter instead of the actual sender [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)
- CSP-blocked pages with font-src/img-src side channels that leak Origin/Referer [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)
- Native popups (select, date picker, context menu) anchored using renderer-supplied rectangles not clipped to the viewport [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-select-your-own-origin-spoofing-chrome-s-address-bar-with-native-ui.md)

## How to review
For each boundary, identify the exact property that must hold and check it is enforced at the trust boundary, not by the untrusted side:
- A new document's origin/URL must be computed from the navigation target, never inherited from the parent or a cached proxy object.
- postMessage origin checks must compare against the real sender origin, not a value passed in the message or URL.
- Native UI geometry must be intersected with the visual viewport before being used to place browser-chrome popups.
- Framework window.open/eval must not let the opener execute in the child's context; privileged schemes must be unreachable from web content.
Enumerate methods whose return values are computed at call time (entries(), baseURI) and test them after navigation to about:blank [E4](https://bugbountylibrary.com/r/blog%3Ajoaxcar-com-blog-2023-10-06-cve-2022-4908-sop-bypass-in-chrome-using-navigation-api.md)[E5](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-using-hackability-to-uncover-a-chrome-infoleak.md).

## Variants seen
- Inherited parent baseURI on about:blank subframe leaks cross-origin parent URL [E5](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-using-hackability-to-uncover-a-chrome-infoleak.md)
- Navigation API copies prior origin's history entries to about:blank [E4](https://bugbountylibrary.com/r/blog%3Ajoaxcar-com-blog-2023-10-06-cve-2022-4908-sop-bypass-in-chrome-using-navigation-api.md)
- BrowserWindowProxy SOP bypass plus privileged chrome-devtools:// URL yields RCE [E3](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html.md)
- Origin leak via font-src side channel plus query-param origin trust in postMessage [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)
- Renderer-supplied select rectangle escapes into browser toolbar for omnibox spoofing [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-select-your-own-origin-spoofing-chrome-s-address-bar-with-native-ui.md)

## Impact and severity
Led to OAuth token/code theft and account takeover [E4](https://bugbountylibrary.com/r/blog%3Ajoaxcar-com-blog-2023-10-06-cve-2022-4908-sop-bypass-in-chrome-using-navigation-api.md)[E5](https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-using-hackability-to-uncover-a-chrome-infoleak.md), RCE in Electron apps and VSCode Restricted Mode [E1](https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md)[E3](https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html.md), and convincing address-bar/download spoofing [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-select-your-own-origin-spoofing-chrome-s-address-bar-with-native-ui.md). Severity rises when the leak reaches credentials or when the bypass chains into code execution; same-site-but-cross-origin framing and privileged URL schemes made it worse.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-electrovolt-io-posts-vscode-rce.md
- E2: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-select-your-own-origin-spoofing-chrome-s-address-bar-with-native-ui.md
- E3: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2017-08-03-electron-framework-security-html.md
- E4: https://bugbountylibrary.com/r/blog%3Ajoaxcar-com-blog-2023-10-06-cve-2022-4908-sop-bypass-in-chrome-using-navigation-api.md
- E5: https://bugbountylibrary.com/r/blog%3Aportswigger-net-research-using-hackability-to-uncover-a-chrome-infoleak.md