Spoofing.

Deleted: screenshot.png 144 KB

	screenshot.png 144 KB View Download

Confirmed. Labeling as Low, since I don't quite see how an attacker would be able to make this too useful.

From  issue 673163 .

Kent - shouldn't be higher than low severity as  issue 673163 ?

Prior art says yes. Thanks.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/a896ff44a395a50ab18f5120f20b7eb5a9550247

commit a896ff44a395a50ab18f5120f20b7eb5a9550247
Author: tkent <tkent@chromium.org>
Date: Mon Mar 27 03:47:21 2017

Form validation: Validation bubble should be closed on document unload process.

This CL fixes a bug that a validation bubble is not closed by page navigation in
some cases.

We close a validation message on Page::documentDetached(). However it seems it was
too late to communicate with the browser process in some cases. So, this CL moves
it to Document unload timing.

 * Add ValidationMessage::willUnloadDocument(), which closes a validation bubble,
  and Document::dispatchUnloadEvents() calls it indirectly through Page.

 * HTMLFormControlElement prevents from showing a validation message after the
  unload processing.

BUG= 704560 

Review-Url: https://codereview.chromium.org/2771193002
Cr-Commit-Position: refs/heads/master@{#459701}

[modify] https://crrev.com/a896ff44a395a50ab18f5120f20b7eb5a9550247/third_party/WebKit/Source/core/dom/Document.cpp
[modify] https://crrev.com/a896ff44a395a50ab18f5120f20b7eb5a9550247/third_party/WebKit/Source/core/dom/DocumentTest.cpp
[modify] https://crrev.com/a896ff44a395a50ab18f5120f20b7eb5a9550247/third_party/WebKit/Source/core/html/HTMLFormControlElement.cpp
[modify] https://crrev.com/a896ff44a395a50ab18f5120f20b7eb5a9550247/third_party/WebKit/Source/core/page/Page.cpp
[modify] https://crrev.com/a896ff44a395a50ab18f5120f20b7eb5a9550247/third_party/WebKit/Source/core/page/Page.h
[modify] https://crrev.com/a896ff44a395a50ab18f5120f20b7eb5a9550247/third_party/WebKit/Source/core/page/ValidationMessageClient.h
[modify] https://crrev.com/a896ff44a395a50ab18f5120f20b7eb5a9550247/third_party/WebKit/Source/web/ValidationMessageClientImpl.cpp
[modify] https://crrev.com/a896ff44a395a50ab18f5120f20b7eb5a9550247/third_party/WebKit/Source/web/ValidationMessageClientImpl.h

Fixed on 59.0.3053.0 Canary.

+awhalley@ for M57/M58 merge review.

Please note we already cut M57 Stable RC for release this week. 

Not taking this for M57, but good for M58 once it's been out on canary for 48 hours+

Your change meets the bar and is auto-approved for M58. Please go ahead and merge the CL to branch 3029 manually. Please contact milestone owner if you have questions.
Owners: amineer@(Android), cmasso@(iOS), bhthompson@(ChromeOS), govind@(Desktop)

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2bf11fe64e121ef8c9603d1b56e972b4800cc3c0

commit 2bf11fe64e121ef8c9603d1b56e972b4800cc3c0
Author: Kent Tamura <tkent@chromium.org>
Date: Wed Mar 29 07:54:14 2017

Merge "Form validation: Validation bubble should be closed on document unload process." to M58

This CL fixes a bug that a validation bubble is not closed by page navigation in
some cases.

We close a validation message on Page::documentDetached(). However it seems it was
too late to communicate with the browser process in some cases. So, this CL moves
it to Document unload timing.

 * Add ValidationMessage::willUnloadDocument(), which closes a validation bubble,
  and Document::dispatchUnloadEvents() calls it indirectly through Page.

 * HTMLFormControlElement prevents from showing a validation message after the
  unload processing.

BUG= 704560 

Review-Url: https://codereview.chromium.org/2771193002
Cr-Commit-Position: refs/heads/master@{#459701}
(cherry picked from commit a896ff44a395a50ab18f5120f20b7eb5a9550247)

Review-Url: https://codereview.chromium.org/2782093003 .
Cr-Commit-Position: refs/branch-heads/3029@{#472}
Cr-Branched-From: 939b32ee5ba05c396eef3fd992822fcca9a2e262-refs/heads/master@{#454471}

[modify] https://crrev.com/2bf11fe64e121ef8c9603d1b56e972b4800cc3c0/third_party/WebKit/Source/core/dom/Document.cpp
[modify] https://crrev.com/2bf11fe64e121ef8c9603d1b56e972b4800cc3c0/third_party/WebKit/Source/core/dom/DocumentTest.cpp
[modify] https://crrev.com/2bf11fe64e121ef8c9603d1b56e972b4800cc3c0/third_party/WebKit/Source/core/html/HTMLFormControlElement.cpp
[modify] https://crrev.com/2bf11fe64e121ef8c9603d1b56e972b4800cc3c0/third_party/WebKit/Source/core/page/Page.cpp
[modify] https://crrev.com/2bf11fe64e121ef8c9603d1b56e972b4800cc3c0/third_party/WebKit/Source/core/page/Page.h
[modify] https://crrev.com/2bf11fe64e121ef8c9603d1b56e972b4800cc3c0/third_party/WebKit/Source/core/page/ValidationMessageClient.h
[modify] https://crrev.com/2bf11fe64e121ef8c9603d1b56e972b4800cc3c0/third_party/WebKit/Source/web/ValidationMessageClientImpl.cpp
[modify] https://crrev.com/2bf11fe64e121ef8c9603d1b56e972b4800cc3c0/third_party/WebKit/Source/web/ValidationMessageClientImpl.h

Nice one! The panel has decided to award $500 for this bug.

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot