# Cross-origin state and timing leaks

Per-user state or timing differences readable cross-origin via stream order, events, or response size

_Area: Web infrastructure and server-side requests. Seen in 6 disclosed reports; 4 confirmed bounties, median $890, range $100-$2,500; latest 2026-10-19. Updated 2026-10-23._

## How it works
A response, event, or byte count carries information about the requester that the browser's isolation model assumes another origin cannot read. The broken assumption is that SOP blocks cross-origin reads, or that processing differences are too small to observe. In practice script imports bypass SOP [E3](https://bugbountylibrary.com/r/h1%3A2244229.md), concurrent HTTP/2 streams expose response ordering [E1](https://bugbountylibrary.com/r/h1%3A493176.md), global events broadcast across tabs [E4](https://bugbountylibrary.com/r/h1%3A257942.md), compression collapses intentional padding [E5](https://bugbountylibrary.com/r/h1%3A29835.md), and wildcard CORS opens loopback services [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md). Any per-user state or content-dependent difference that reaches the client becomes a boolean oracle.

## Where it shows up
- Dynamically templated JS (sw.js, manifest, config) embedding userId or session state [E3](https://bugbountylibrary.com/r/h1%3A2244229.md)
- Endpoints whose processing time differs on hit vs miss (search, lookup) [E1](https://bugbountylibrary.com/r/h1%3A493176.md)
- Shared response helpers emitting `Access-Control-Allow-Origin: *` on read routes [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md)
- Global events (languagechange) fired simultaneously across tabs [E4](https://bugbountylibrary.com/r/h1%3A257942.md)
- Length-hiding padding on resources later served with gzip/br [E5](https://bugbountylibrary.com/r/h1%3A29835.md)

## How to review
Triage in this order: (1) SOP bypass — fetch each dynamically generated JS cross-origin and diff per-session to confirm no user-specific values [E3](https://bugbountylibrary.com/r/h1%3A2244229.md); (2) CORS — grep every shared response helper for wildcard ACAO and confirm which routes lack Origin checks [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md); (3) ordering — check whether hit/miss paths differ measurably and whether concurrent streams on one connection can order responses [E1](https://bugbountylibrary.com/r/h1%3A493176.md); (4) events — confirm global broadcasts are suppressed for all sibling event types [E4](https://bugbountylibrary.com/r/h1%3A257942.md); (5) size — verify compression is off on padded resources and measure compressed sizes [E5](https://bugbountylibrary.com/r/h1%3A29835.md). The invariant: observable output (order, size, timing, event, readable body) must not depend on victim state.

## Variants seen
- Concurrent HTTP/2 stream ordering as a search oracle [E1](https://bugbountylibrary.com/r/h1%3A493176.md)
- Wildcard CORS on loopback status server exposing control-plane state [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md)
- Per-user userId in cross-origin-importable sw.js [E3](https://bugbountylibrary.com/r/h1%3A2244229.md)
- Simultaneous languagechange across tabs correlating visits [E4](https://bugbountylibrary.com/r/h1%3A257942.md)
- GZIP defeating length-hiding padding [E5](https://bugbountylibrary.com/r/h1%3A29835.md)

## Why fixes fail
Suppressing one global event (online/offline) left sibling events leaking; languagechange was overlooked [E4](https://bugbountylibrary.com/r/h1%3A257942.md). Adding padding without disabling compression restored leakage when perf enabled gzip [E5](https://bugbountylibrary.com/r/h1%3A29835.md).

## Impact and severity
Deanonymization, private-content search, browsing-history disclosure, local control-plane exposure. Worse when the oracle is boolean and repeatable, or when one leaked identifier links sessions.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A493176.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-vx2m-gpq4-8j5q.md
- E3: https://bugbountylibrary.com/r/h1%3A2244229.md
- E4: https://bugbountylibrary.com/r/h1%3A257942.md
- E5: https://bugbountylibrary.com/r/h1%3A29835.md