title: Possible vulnerability by content disposition header
body: <p>Consider a response with Content-Type: application/json;charset=UTF-8 header and Content-Disposition: attachment;filename=text.txt header, with content-disp header appearing first , i am able to use the content-disp in my favor as a CSRF attack which make the file autodownload on the victim machine by including the URL as src in an iframe but if i am doing fetch i am blocked by CORB as the response does have application/json as content-type is there any way to smuggle the data i was able to download to a remote server</p>