SameSite restrictions are lifted, and SameSite:Strict cookie are being sent.

How it was found

Summary:

hello, Brave team. There are cases where the SameSite policy is being bypassed, and I would like to report them. When a user left-clicks a link in a cross-domain context and selects "Open Link in Split View," all cookies—including those with SameSite=Strict—are sent, even though it is a cross-site navigation.

• For SameSite cookies, only SameSite=Lax cookies should be sent during cross-site navigations.

Before providing a detailed explanation, here is a list of CVEs and issues that were reported as a result of SameSite violations.: https://issues.chromium.org/issues/40057062 https://issues.chromium.org/issues/40050641 https://issues.chromium.org/issues/40057831 https://issues.chromium.org/issues/40053069 https://issues.chromium.org/issues/40091708 https://issues.chromium.org/issues/40091123 https://issues.chromium.org/issues/40091076 https://issues.chromium.org/issues/40091073 https://issues.chromium.org/issues/40091053 https://issues.chromium.org/issues/40091031 https://issues.chromium.org/issues/40090228 https://issues.chromium.org/issues/40087297 https://issues.chromium.org/issues/41385446 https://bugzilla.mozilla.org/show_bug.cgi?id=1873223&_gl=1*p8erhc*_ga*MTU3OTk5MjUwOC4xNzQxNTg0MzY3*_ga_MQ7767QQQW*czE3NDgzMjQ2NTYkbzMkZzEkdDE3NDgzMjQ3NTUkajAkbDAkaDA. https://bugzilla.mozilla.org/show_bug.cgi?id=1844827&_gl=1*1pdtywb*_ga*MTU3OTk5MjUwOC4xNzQxNTg0MzY3*_ga_MQ7767QQQW*czE3NDgzMjQ2NTYkbzMkZzEkdDE3NDgzMjQ4MjQkajAkbDAkaDA. https://bugzilla.mozilla.org/show_bug.cgi?id=1456652&_gl=1*1739v6q*_ga*MTU3OTk5MjUwOC4xNzQxNTg0MzY3*_ga_MQ7767QQQW*czE3NDgzMjQ2NTYkbzMkZzEkdDE3NDgzMjU3NjIkajAkbDAkaDA. https://nvd.nist.gov/vuln/detail/CVE-2018-12402 https://nvd.nist.gov/vuln/detail/cve-2022-29912 https://nvd.nist.gov/vuln/detail/cve-2022-45410 https://nvd.nist.gov/vuln/detail/cve-2022-45413 CVE-2023-30674

There was a case similar to the vulnerability that we are reporting, where a SameSite=Strict cookie was bypassed due to user interaction.: https://issues.chromium.org/issues/40091708

The reason SameSite=Strict cookies are being sent in this case is because the Sec-Fetch-Site: cross-site header, which should normally be present, is missing. To prevent SameSite bypass and protect against CSRF attacks, this header should be properly included in the request.

thank you for reading.

Products affected:

Brave 1.80.120 in window operation

Steps To Reproduce:

<a href='https://SameSite.check.com' target='_blank'>1234</a>" frameborder="0">

Try opening the hyperlink above using the "Open Link in Split View" option — even SameSite=Strict cookies are sent.

Try opening the link using other options as well—such as "Open in New Tab" or "Open in Incognito Window"—and compare the cookies that are sent in each case.

A video demonstrating the proof of concept (POC) has been included.

Supporting Material/References:

https://issues.chromium.org/issues/40091708 https://issues.chromium.org/issues/40057062 https://issues.chromium.org/issues/40050641 https://issues.chromium.org/issues/40057831 https://issues.chromium.org/issues/40053069 https://issues.chromium.org/issues/40091708 https://issues.chromium.org/issues/40091123 https://issues.chromium.org/issues/40091076 https://issues.chromium.org/issues/40091073 https://issues.chromium.org/issues/40091053 https://issues.chromium.org/issues/40091031 https://issues.chromium.org/issues/40090228 https://issues.chromium.org/issues/40087297 https://issues.chromium.org/issues/41385446 https://bugzilla.mozilla.org/show_bug.cgi?id=1873223&_gl=1*p8erhc*_ga*MTU3OTk5MjUwOC4xNzQxNTg0MzY3*_ga_MQ7767QQQW*czE3NDgzMjQ2NTYkbzMkZzEkdDE3NDgzMjQ3NTUkajAkbDAkaDA. https://bugzilla.mozilla.org/show_bug.cgi?id=1844827&_gl=1*1pdtywb*_ga*MTU3OTk5MjUwOC4xNzQxNTg0MzY3*_ga_MQ7767QQQW*czE3NDgzMjQ2NTYkbzMkZzEkdDE3NDgzMjQ4MjQkajAkbDAkaDA. https://bugzilla.mozilla.org/show_bug.cgi?id=1456652&_gl=1*1739v6q*_ga*MTU3OTk5MjUwOC4xNzQxNTg0MzY3*_ga_MQ7767QQQW*czE3NDgzMjQ2NTYkbzMkZzEkdDE3NDgzMjU3NjIkajAkbDAkaDA. https://nvd.nist.gov/vuln/detail/CVE-2018-12402 https://nvd.nist.gov/vuln/detail/cve-2022-29912 https://nvd.nist.gov/vuln/detail/cve-2022-45410 https://nvd.nist.gov/vuln/detail/cve-2022-45413 CVE-2023-30674

Impact

{F4569378}