HackerOne · Report #1159398
New link opening method makes hackerone vulnerable to tabnabbing
Validstatus
lowseverity
51upvotes
7 Jul 2021disclosed
How it was found
Summary: Hackerone recently changed how it opens the external links and this new way is vulnerable to tabnabbing. Description: Please see the POC.
Steps To Reproduce
- Click here: https://awasthi7.github.io/
- Click on proceed when warning appears.
- The site will open in new tab and hackerone tab will be replaced by Google.
Optional: Your Environment (Browser version, Device, etc)
Optional: Supporting Material/References (Screenshots)
Impact
Unvalidated redirect