-------------------------

VULNERABILITY DETAILS

When a user authenticates on any website in incognito mode of the google chrome, it is expected that his session is private, although that is not happening, once user is authenticate the internal URL of website gets accessible on new incognito window.
Expectation here is , every incognito window should ask for new authentication.


VERSION
Chrome Version: [71.0.3578.98 (Official Build) (64-bit)]
Operating System: [Windows 10 Gold Engineering v6]

REPRODUCTION CASE

1. Open chrome in incognito mode.
2. Login to any application for example amazon.in
3. copy any post authentication URL.
4. Open another incognito window.
5. Paste the copied URL

Actual behavior : Page is successfully rendered
Expected : login page should be displayed. 

CREDIT INFORMATION
Externally reported security bugs may appear in Chrome release notes. If
this bug is included, how would you like to be credited?
Reporter credit: [Pravesh Jha]

 

Deleted: Incognito_Issue.png 161 KB

	Incognito_Issue.png 161 KB View Download