VULNERABILITY DETAILS
EV SSL certificate from redirecting website persists from URL redirect, i.e. the SSL cert from site one shows up as valid on site 2, even if the connection on site 2 isn't valid.

I have an extension (KB SSL) which forces SSL and might be related to reproducing the bug.

Not sure what other versions this is reproducible in.

VERSION
Chrome Version: Version 55.0.2846.4 canary (64-bit)
Operating System: Mac OSX 10.11.1

REPRODUCTION CASE
    1. Force https (unknown if necessary)
    2. Go to twitter or another site with a URL redirect with https
        a. e.g. https://twitter.com/SpaceX/status/771871484167925761
        b. site may need invalid https cert
    3. Click the outbound link which is redirected by t.co

Note that chrome displays Twitter's EV SSL cert even when the redirect is finished and the user is on another site.
 

Deleted: Screen Shot 2016-09-03 at 5.05.54 PM.png 88.1 KB

	Screen Shot 2016-09-03 at 5.05.54 PM.png 88.1 KB View Download

Deleted: Screen Shot 2016-09-03 at 4.41.09 PM.png 123 KB

	Screen Shot 2016-09-03 at 4.41.09 PM.png 123 KB View Download