VULNERABILITY DETAILS

when navigating to a URL with a 204 response or download file, chrome does not change the URL of the address bar and the current page will stop loading.

VERSION
Chrome Version: 54.0.2840.90 (64-bit) stable
Operating System: Ubuntu 16.04.1 LTS

REPRODUCTION CASE

Address Bar URL spoofing

1.click the link, open a window and navigate to the URL that contains anything we want to display.
2.navigate the window to www.amazon.com, once the address bar changes navigate to the URL with the 204 response.

Download spoofing

1.click the download link, open a window and navigate to the download page.
2.when the download page loads completely, navigate to the fake download URL.
3.the download dialog box for the fake download file is pop-up, and the real download file will be intercepted by the chrome, see download_spoofing-2.jpg.