Issue metadata
Sign in to add a comment
|
Spoof with Google Translate
Reported by
jm.acun...@gmail.com,
Apr 21 2017
|
||||||||||||||||||||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.81 Safari/537.36 Steps to reproduce the problem: The spoof is credible because it is based on the interaction of the user by clicking on the icon of the address bar of the browser, action totally independent of the web page that is viewing. 1- Go to http://createcharts.esy.es/spoof-translate.html 2- Click the translation icon in the address bar 3- Click on the Reload button The Reload button show a layer with Google credentials to redisplay the page. The message could be: "Please sign in to Google to re-establish the service" What is the expected behavior? What went wrong? An html element with id = "goog-gt-tt" and class = "skiptranslate" causes error in ajax requests and hides the content of the element. Did this work before? N/A Chrome version: 58.0.3029.81 Channel: stable OS Version: 6.3 Flash Version: Shockwave Flash 25.0 r0
,
Apr 21 2017
Can you add screenshots showing where you think there's a problem? I /think/ the weakness you're identifying here is that the user might be confused and think that markup they see after clicking "Translate" is coming from Google while in reality it's supplied by an attacker? And the user might react to the "fake" error page by supplying their Google credentials? The omnibox isn't spoofed at any point, right?
,
Apr 22 2017
,
Apr 24 2017
1) Can you add screenshots showing where you think there's a problem? - Not necessary, the test case is well explained 2) I /think/ the weakness you're identifying here is that the user might be confused and think that markup they see after clicking "Translate" is coming from Google while in reality it's supplied by an attacker? - Totally agree 3) And the user might react to the "fake" error page by supplying their Google credentials? - It is likely that certain users will enter their credentials 4) The omnibox isn't spoofed at any point, right? - It is clear that no
,
Apr 24 2017
Thank you for providing more feedback. Adding requester "meacer@chromium.org" to the cc list and removing "Needs-Feedback" label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Apr 24 2017
When I asked for screenshots, it's because you filed this bug feeling that there's a compelling spoof; screenshots might help make that case. I do not experience anything I would consider a spoof here.
,
Apr 25 2017
Based on the description in comment #4, there doesn't seem to be a spoof of browser chrome or the omnibox, so closing as WontFix. jm.acuna73@: If you could provide screenshots pointing to an omnibox spoof we can reopen the bug, thanks.
,
Apr 27 2017
,
Aug 1 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by jm.acun...@gmail.com
, Apr 21 2017