CVE-2010-0660 in Chrome
Summary
by MITRE
Google Chrome before 4.0.249.78 sends an https URL in the Referer header of an http request in certain circumstances involving https to http redirection, which allows remote HTTP servers to obtain potentially sensitive information via standard HTTP logging.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 05/01/2026
This vulnerability in Google Chrome versions prior to 4.0.249.78 represents a significant security flaw related to cross-protocol referer header handling. The issue occurs when users navigate from secure https pages to insecure http pages through redirection mechanisms, creating an unexpected information leakage scenario. The technical implementation flaw stems from Chrome's failure to properly sanitize the referer header during protocol transitions, specifically when https content references http resources. This behavior violates fundamental web security principles and creates a pathway for malicious actors to harvest sensitive information from users' browsing sessions.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to gather potentially sensitive data through standard HTTP logging mechanisms. When an https page contains links or resources that redirect to http pages, the original https URL becomes embedded in the referer header of the subsequent http request. This creates a situation where remote HTTP servers can access the full URL path, including any query parameters, session identifiers, or other sensitive information that was previously protected by the secure https protocol. The vulnerability is particularly concerning because it operates transparently without user interaction, making it difficult to detect and prevent through standard security measures.
From a cybersecurity perspective, this vulnerability aligns with CWE-200, which addresses information exposure, and demonstrates characteristics consistent with ATT&CK technique T1071.004 for application layer protocol manipulation. The flaw represents a failure in proper protocol handling and header sanitization, creating an information leakage channel that bypasses normal security boundaries. Security researchers have noted that this type of vulnerability is particularly dangerous because it can be exploited by malicious servers that are not directly involved in the user's browsing session, simply by intercepting and analyzing standard HTTP logs. The vulnerability also highlights the importance of proper cross-protocol security boundary management in web browsers, as it demonstrates how protocol transitions can create unexpected security gaps.
The mitigation strategy for this vulnerability involves updating to Chrome version 4.0.249.78 or later, which implements proper referer header handling during protocol transitions. Organizations should also consider implementing additional network-level protections such as referer header filtering and monitoring for unusual referer patterns. Security teams should conduct vulnerability assessments to identify systems that may be exposed to this attack vector, particularly those that rely on http protocols for sensitive operations. The fix implemented by Google addresses the core issue by ensuring that referer headers are properly sanitized when transitioning from https to http contexts, preventing the leakage of secure protocol information to insecure destinations. This remediation approach aligns with industry best practices for preventing information disclosure vulnerabilities and demonstrates the importance of maintaining proper protocol boundaries in web browser implementations.