HackerOne · Report #189726
Websites opened from reports can change url of report page
Validstatus
mediumseverity
50upvotes
25 Feb 2017disclosed
How it was found
This issue is similar to #124889, but it is only exploitable via MS Edge or Internet Explorer 11
Proof Of Concept: Clicking on a link set to "http://d214mfsab.org/same.html" (including this one) will change the still-open report page to http://example.com. This works on current versions of MS Edge and Internet Explorer 11.