Aditya, > Video: http://www.secniche.org/videos/google_chrome_link_inj.html You might find it informative to review the section of BSH on URL parsing: http://code.google.com/p/browsersec/wiki/Part1#Uniform_Resource_Locators There are many known quirks related to URL parsing; the practice of certain browsers to tokenize the authority section using the rightmost @ sign, in particular, is documented there. Three other spectacular examples include: http://example.com;.coredump.cx/ - MSIE will take you somewhere else than most other browsers would http://example.com\@coredump.cx/ - means one thing to most browsers, something else to Firefox https:example.com - absolute to Firefox (while http:example.com is a relative link in that same browser) In essence, any site that accepts, but does not normalize and rewrite relative / not well formed URLs, and hopes to achieve any degree of control over the destination of that link, is bound to fail. The particular example in your video seems to be a clear case of insufficient validation, and not a browser bug. It is also unfortunate that URL parsing is deceptively difficult for humans, but that's the way it is; address bar host name highlighting and auto-hiding of credentials is the only sensible approach I can think of; crippling URL syntax, on the other hand, seems heavy-handed. /mz
