Issue 671587 link

Starred by 1 user

Issue metadata

Status:	WontFix
Owner:	----
Closed:	Dec 2016
EstimatedDays:	----
NextAction:	----
OS:	----
Pri:	----
Type:	Bug-Security

Security: xss in webbrowser by typing javascript in the address bar

Reported by thisisfo...@gmail.com, Dec 6 2016

Issue description

This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

Please READ THIS FAQ before filing a bug: https://www.chromium.org/Home
/chromium-security/security-faq

Please see the following link for instructions on filing security bugs:
http://www.chromium.org/Home/chromium-security/reporting-security-bugs

NOTE: Security bugs are normally made public once a fix has been widely
deployed.

VULNERABILITY DETAILS
Please provide a brief explanation of the security issue.If you open chrome and put in javascript:alert(document.cookie) it is able to grab the cookie for chrome. If a user was logged into there gmail account, an attacker could use this to grab this information.

VERSION
Chrome Version: Version 55.0.2883.75 m (64-bit) + stable, operating system windows 7. service pack 1.

[x.x.x.x] + [stable, beta, or dev]
Operating System: [Please indicate OS, version, and service pack level]

REPRODUCTION CASE
Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [tab, browser, etc.]
Crash State: [see link above: stack trace, registers, exception record]
Client ID (if relevant): [see link above]

	xss 2.PNG 18.0 KB View Download

Comment 1 Deleted

Comment 2 by elawrence@chromium.org, Dec 6 2016

Labels: -Restrict-View-SecurityTeam -Needs-Feedback
Status: WontFix (was: Unconfirmed)
Summary: Security: xss in webbrowser by typing javascript in the address bar (was: Security: xss in webbrowser.)

From https://dev.chromium.org/Home/chromium-security/security-faq#TOC-Does-entering-JavaScript:-URLs-in-the-URL-bar-or-running-script-in-the-developer-tools-mean-there-s-an-XSS-vulnerability-

"Q: Does entering JavaScript: URLs in the URL bar or running script in the developer tools mean there's an XSS vulnerability?"

A: No. Chrome does not attempt to prevent the user from knowingly running script against loaded documents, either by entering script in the Developer Tools console or by typing a JavaScript: URI into the URL bar. Chrome and other browsers do undertake some efforts to prevent *paste* of script URLs in the URL bar (to limit social-engineering) but users are otherwise free to invoke script against pages using either the URL bar or the DevTools console. 

Similarly, users may create bookmarks pointed at JavaScript URLs that will run on the currently-loaded page when the user clicks the bookmark; these are called bookmarklets.

►