·10 min read
Weaponizing unicode case folding and URL inflation to create a new XS-Search oracle
a novel URL inflation gadget — branch-dependent unicode case folding pushes a redirect past chromium's 2 MiB URL limit, turning a query-normalization mistake into a clean cross-origin search oracle.