PortSwigger Said Chrome Updates Broke Its CSRF Lab. My Tests Tell a Different Story

While I was working my way through PortSwigger's Web Security Academy, I reached the CSRF section.

On August eleventh, I was almost done with it, with only one lab left, Same-Site Lax Bypass Via Cookie Refresh.

Every time I tried to launch it, I got the same error.

Greater than apologies, the lab could not be started in a timely manner.

Please try again greater than or contact us if the problem persists.

After trying several times with no luck, I decided to email PortSwigger support at support@portswigger.net. Five hours later, I got a reply.

The issue was caused by recent updates to the victim's browser, which was now running Chrome one hundred and fifty.

As a result, the lab was no longer solvable on modern browsers, so it had been disabled and would be retired.

Even though I'm someone who doesn't take things at face value and usually prefers to dig for evidence myself, I let my guard down this time.

I told myself PortSwigger obviously knows their own labs and their own vulnerabilities better than I do, so if they said that, it must be true.

Less than twenty-four hours later, the lab had been completely removed from the platform, dropping the total lab count from two hundred seventy-four to two hundred seventy-three.

Along with it, they also deleted the entire theory section titled Bypassing Same-Site Lax Restrictions With Newly Issued Cookies from inside the Bypassing Same-Site Cookie Restrictions topic, itself part of the CSRF topic.

The beginning, I completely forgot about the deleted lab until the end of August, when a question crossed my mind.

Why not actually look up the news about this vulnerability being removed from modern browsers? The first surprise was that there was nothing to find, no mention anywhere of this behavior being removed from Chrome.

So I told myself, "Fine, let's just go straight to the source, the official Chrome one hundred and fifty release notes." I went through them line by line, and there wasn't a single mention of any change to cookie behavior, let alone to this two-minute grace window specifically.