← All tests
THIS PAGE IS THE ATTACKER, served from . The address bar is lying.

De-AMP omnibox spoof

This document is served by the attacker origin (). It never navigates away. A few seconds after it loads it triggers De-AMP on its own (no click needed), and the address bar changes to while this page stays on screen and the counter below keeps running.

Live tick since attacker page loaded: 0

Auto-triggering in 5s.

What happens

  1. This page commits and starts counting.
  2. It sets location.href = 'amp.html' (same-origin, always allowed).
  3. amp.html is an AMP document whose <link rel="canonical"> points at an endpoint that never answers the connection (a filtered port that silently drops the TCP SYN).
  4. Brave's De-AMP cancels amp.html and re-issues a browser-initiated navigation to the canonical URL.
  5. Because the endpoint never answers, the navigation stays pending and the spoofed URL stays in the omnibox over this still-rendered page.