VERSION
Chrome Version: 53.0.2765.0 canary
Operating System: Windows 7

REPRODUCTION CASE
The parser that handles data URI schemes does not consider the 'hash' symbol which could lead to tricking a victim into thinking they're in a trusted website.

new URL('data:#;,test'); This is a valid data URL.

new URL('data:#'); And this is an invalid URL.

So let's trick the browser into forming the second URL using this flaw.

PoC: 

<a href="data:#q;,<b>qab</b><script>location.hash=''</script>">click</a>


Actual results:
We end up in 'data:#' that contains the document from the initial data: url.

Expected results:
The parser should not allow the hash symbol before the ',' character.

 

Deleted: testcase.html 825 bytes

testcase.html 825 bytes View Download