CVE-2016-9078

What it actually does

Redirection from an HTTP connection to a data: URL assigns the referring site's origin to the data: URL, enabling same-origin violations and cross-origin cookie setting without read access.

Why it matters to the business

Attackers can potentially hijack sessions or perform unauthorized actions on domains by setting cookies cross-origin, increasing risk of account compromise and data exposure for users of affected browsers.

How an attack unfolds

An attacker hosts a malicious site that performs an HTTP-to-data: URL redirect; when a victim visits, the data: URL inherits the referring origin allowing cookie setting on the target domain without further interaction.

How to fix it

Upgrade affected chromium packages to the fixed versions listed: 71.0.3578.80-1 for Debian 11/12/13 and 71.0.3578.80-0ubuntu0.16.04.1 for Ubuntu 16.04 LTS. Apply updates immediately given exploit availability.

How to confirm the fix worked

Verify browser version is at or above the fixed releases; test redirect behavior with crafted HTTP-to-data: URLs to confirm origin isolation; review update logs for successful package upgrades.

Typical attack path

1. Attacker crafts malicious page with HTTP redirect to data: URL
2. Victim is lured to visit the malicious page
3. Browser assigns referring origin to data: URL
4. Cross-origin cookies are set on the target domain
5. Attacker leverages set cookies for session manipulation or further attacks

How to detect it

Review browser logs and proxy logs for unusual HTTP redirects to data: URLs; look for unexpected cookie-setting events from cross-origin sources in web server access logs.

What your security team should do

• Prioritize patching all listed chromium packages to fixed versions within 48 hours due to public exploit
• Monitor browser update channels for rapid deployment
• Educate users on avoiding untrusted redirects
• Audit web applications for reliance on cookie-based auth that could be impacted