VULNERABILITY DETAILS
On clicking a hyperlink for twitter.com, user expects the browser to move to twitter.com. Now browser only make one call to twitter.com when user clicks on the link. With this trick, when user clicks on the link, chrome will hit twitter 22 times instead of 1 time (can be increased easily to hundreds, but did not wanted to get my ip blacklisted:) ) and post that chrome will finally redirect to twitter.com
User wont notice anything malicious here and would unknowingly be sending large amount of traffic from his computer network. No new tab will open in this attack so that user wont be able to identify the attack.

VERSION
Chrome Version: 54.0.2840.71 m (64-bit)
Operating System: Windows 10

REPRODUCTION CASE
1) Use a HTTP intercepter like Burp to record network logs
2) Open the attached Chrome.html
3) Click on Open Twitter
4) Twitter will open but if you check your network logs in burp you will see Chrome called twitter 22 times instead of once (22 can be increased to very large value by extending number of iframe in the script)

Note:
This problem does not occur in Firefox because Firefox did not waited for the script to complete and instead moved to twitter.com instantly hence saving the user from the attack.

 

Deleted: chrome.html 1.3 KB

chrome.html 1.3 KB View Download