# Unvalidated URL scheme navigation

Server- or feed-supplied URLs opened without a scheme allowlist, reaching chrome:, javascript:, file: or spoofed bars

_Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; latest 2023-06-22. Updated 2026-11-01._

## How it works
A feature takes a URL from an untrusted source (a server header, a feed item, a link) and hands it to a navigation/open primitive. The code assumes the value is an ordinary web URL, so it skips the scheme check that normal link handling applies. Any scheme the platform treats as privileged or special — `chrome:`, `javascript:`, `file:`, or a malformed scheme — is then executed with the caller's trust, breaking the boundary between web content and browser/privileged UI.

## Where it shows up
- A header value (e.g. `Onion-Location`) passed straight to an open/navigate call [E1](https://bugbountylibrary.com/r/h1%3A1089995.md)
- Feed or aggregator item links rendered in a privileged surface (new tab, news panel) [E2](https://bugbountylibrary.com/r/h1%3A1819668.md)
- Protocol-handler or unknown-scheme navigation that leaves the address bar showing attacker-chosen text [E3](https://bugbountylibrary.com/r/h1%3A373721.md)
- Code that sanitizes HTML but never inspects the URL scheme [E2](https://bugbountylibrary.com/r/h1%3A1819668.md)
- Malformed schemes with trailing dots (`http.://`) that defeat scheme recognition [E3](https://bugbountylibrary.com/r/h1%3A373721.md)

## How to review
Find every place an untrusted URL reaches open/navigate/fetch. The invariant: before navigation, the scheme must be parsed and matched against an explicit allowlist (`https`, and `onion` only where intended); anything else is rejected, not merely stripped. Check that the check runs on the parsed scheme, not a substring, and that malformed schemes fail closed. For header-driven navigation, confirm the header is treated as data, never as a command to open a privileged page [E1](https://bugbountylibrary.com/r/h1%3A1089995.md). For feed content, confirm item links are scheme-filtered, not just HTML-escaped [E2](https://bugbountylibrary.com/r/h1%3A1819668.md). For protocol-handler windows, confirm the address bar resets to `about:blank` when a parent accesses the window [E3](https://bugbountylibrary.com/r/h1%3A373721.md).

## How finders spotted it
- Read the PR adding the feature and saw the header value opened without scheme restriction, then tried `chrome://restart/` [E1](https://bugbountylibrary.com/r/h1%3A1089995.md)
- Suspected feed links were navigated without scheme restriction and tested a `chrome://settings` item [E2](https://bugbountylibrary.com/r/h1%3A1819668.md)
- Noticed other browsers reset to `about:blank` on protocol-handler access, tested a malformed scheme and saw the bar unchanged [E3](https://bugbountylibrary.com/r/h1%3A373721.md)

## Variants seen
- Server-controlled header triggers navigation to arbitrary scheme [E1](https://bugbountylibrary.com/r/h1%3A1089995.md)
- Feed/RSS item URL opened as privileged page [E2](https://bugbountylibrary.com/r/h1%3A1819668.md)
- Malformed scheme leaves spoofed address bar, enabling cross-window content write [E3](https://bugbountylibrary.com/r/h1%3A373721.md)

## Impact and severity
Reaching privileged `chrome://` pages bypasses SOP and can reset settings [E2](https://bugbountylibrary.com/r/h1%3A1819668.md) or restart the browser; with auto-redirect enabled, a single click becomes an endless restart loop (DoS) [E1](https://bugbountylibrary.com/r/h1%3A1089995.md). Address-bar spoofing enables convincing phishing [E3](https://bugbountylibrary.com/r/h1%3A373721.md). Impact rises when the privileged page is reachable without further interaction and when the trigger is automatic.

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1089995.md
- E2: https://bugbountylibrary.com/r/h1%3A1819668.md
- E3: https://bugbountylibrary.com/r/h1%3A373721.md