Hi,

I would like to report about Open Redirect in Google Chrome  / Desktop / OS 

I've just discovered in my browser version 54.0.2840.59 .

if attacker put site https after @ victim redirect to site https also with http .

I try this with https://facebook.com/ and  https://gmail.com/ 

POC 

https://www.facebook.com@google.com / https://gmail.com@evil.com


Regards
Hussain