De-AMP Tests – Test Website A

De-AMP Omnibox URL Spoof

De-AMP re-issues the canonical navigation as browser-initiated (is_renderer_initiated hard-coded false), which lets Chromium show the pending canonical URL in the omnibox. Pointing the canonical link at a dropped-SYN endpoint keeps the navigation pending, so an attacker's page paints an arbitrary https URL over its own content.

omnibox-spoof/

De-AMP CSP Sandbox Bypass

Tests whether De-AMP redirects a page to its attacker-controlled canonical URL even when the response is served with Content-Security-Policy: sandbox, a header that should forbid the page from navigating the top-level frame.

csp-sandbox/

De-AMP Content-Disposition: attachment Bypass

Tests that AMP pages served with Content-Disposition: attachment are downloaded, not De-AMPed.

download/

De-AMP Sec-Fetch-Site Bypass

Tests whether De-AMP redirects preserve the cross-site hop in the Sec-Fetch-Site header.

sec-fetch-site/