Thanks for the report.

hiroshige: Can you please take a look at this one too?

Many thanks for reporting!

> 3. Alert of "NG: CORS bypassed." if CORS was bypassed.
Actually, the original exploit6b.py alerts "NG: CORS bypassed." in two cases:

[Case 1] The Console tab of DevTools shows "LOADThis is dummy" (see attached image).
This is safe, because dummy data from localhost (not from facebook) is accessed by the script.

[Case 2] the Console tab of DevTools shows "LOAD" and long, real contents of facebook.
This is a security issue.

(I uploaded exploit6b_2.py that alerts "NG: CORS bypassed." only in Case 2)

I reproduced Case 1 locally but I couldn't reproduce Case 2 on:
- 54.0.2840.99 on Windows 7
- 54.0.2840.100 on Linux
- 56.0.2915.0 on Windows 7
- 57.0.2926.1 on Windows

Which case did you observe in Step 4?
> 4. Open DevTools to see the contents of |URL| accessed from 

If you observe Case 2, how frequently does it occur, and did it occur before?

Deleted: LOADdummy.png 9.8 KB

	LOADdummy.png 9.8 KB View Download

Hmm... I can observe only the Case 1, but I didn't realize that was safe.

Closing as per Comment #5.

Thanks again for reporting and keeping eyes on Chromium!!

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot