Maybe you want to show this to one of the cced networking folks. I can't say what is going wrong here, but does not look like a Chrome bug, so closing.

Agreed with inferno, this likely isn't a Chrome security issue specifically.


A couple questions for the reporter:

 * What version of Chrome are you running? (Version 48 switched to using WkWebView)

 * www.cnn.com is an HTTP (not HTTPS) page and is trivial to man-in-the-middle. If you are on a public network this could be as simple as redirecting the DNS, or having an HTTP proxy serve up content.... Although from the bug report you say you are on cellular not wifi - who is your carrier?

 * Do you see scam webpages for any other site? Are any of these sites being served over https:// ? (If you only see scam sites that are on http:// URLs it is fairly likely this hijacking is coming from the network level).

 * Do you see the same scam webpage when loading www.cnn.com from Safari?

> All I did was attempt to visit cnn.com while out at dinner.  The same thing happened to my husband's phone.

Is your husband also using an iPhone?

I wonder if it is possible that while at the restaurant your phones connected to a malicious wifi.

Do you still get the wrong cnn.com when force reloading now?

Thanks for looking in to this.

Yes, he is using an iphone - we were both using chrome.

Neither one of us was connected to wifi, we were both on cell (at&t).  

I can load cnn.com just fine now after restarting the phone and then I did end up clicking on the popup.  (It would be nice to be able to get around those popups without clicking on them.  The tab close button was not clickable.)

The chrome version is: 47.0.2526.107

I didn't see it for any other pages at the time, but I stopped trying when it happened.  I was able to load other pages in safari at the time.


I can try going over near that location this weekend to see if I can repro.

I wasn't exactly sure where to report this, since it was saying google was providing the "prize" and it happened in chrome, I just wanted to make sure it was at least reported somewhere.  I have a screenshot if you want that.  Or if you know of a team that is interested in trademark infringement, please let me know.

Thank you!

Hmm I don't know then.

Certainly I wouldn't put it past a problem with www.cnn.com either.

Could have also been that everything here was working as intended, and you hit a particularly egregious advertisement being "legitimately" served off their site. It managed to popup and steal focus. Perhaps targetted specifically at Chrome User-Agent.

+rsleevi fyi in case he has ideas.

Quick update:  We went back to eat at the same place.  No issues this time.

Even if it was an attack on cnn, would it be possible to allow users to close the tab/window instead of being forced to click on their popup?

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot