Collected research

#307670 Difference in query string parameter processing between Hacker News and Keybase Chrome extension spawns chat to incorrect user

The Keybase browser extension fix for a query-string parsing differential: its parser now rejects duplicate parameter keys instead of silently keeping one, so a crafted link can no longer make the extension open a chat with a different user than the host page displays. The same commit escapes the dots in the regexes that decide which site a page belongs to.

Record

Published by

GitHub

Topic

Browser

In the archive

• Collected in the 2018 research round

Related sources

• browser: v1.10.8, fixes to url matchers and dep upgrade (#10277) Code

Tags

• parser-differential
• url-parsing
• browser-extension
• filter-bypass
• javascript
• mitigation
• github
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of GitHub, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.