Prerequisites

• I verified that this is not a filter issue (MUST be reported at filter issue tracker)
• This is not a support issue or a question
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue
• The issue is not present after wholly disabling uBlock Origin ("uBO") in the browser
• I checked the documentation to understand that the issue I report is not a normal behavior

I tried to reproduce the issue when...

• uBO is the only extension
• uBO with default lists/settings
• using a new, unmodified browser profile

Description

(The issue is present after disabling uBlock Origin in the browser.)

The HTTP referral header leaks potentially identifying and frequently unwanted information about the user.

A specific URL where the issue occurs

https://www.google.com/search?q=test+your+referrer+url+vividata

Steps to Reproduce

1. Open the specific url above.
2. Click on the first link in the search results: https://members.vividata.ca/test-your-referrer-url/
3. Observe that the previous site can be found from the HTTP referrer.

Expected behavior

uBlock Origin could add blocking the HTTP referral header as a privacy setting.

There is (to my knowledge) no upside to the referral header, from a user experience.

Actual behavior

The referral header is not blocked or spoofed, and sites can find out the previous page you visited. This has privacy implications, particularly around fingerprinting - but more generally, it's just excess information that is usually used in a bad way.

Here's an example of the referral header being used for malicious purposes (click on the article link, potentially NSFW): https://news.ycombinator.com/item?id=3132752

uBlock Origin version

1.36.2

Browser name and version

Ungoogled Chromium 91.0

Operating System and version

Arch Linux 5.12