New issue
Advanced search Search tips

Issue 722059 link

Starred by 1 user

Issue metadata

Status: Duplicate
Merged: issue 126398
Owner: ----
Closed: May 2017
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: Full-text display of google account password saved with smart lock

Reported by jul.th...@gmail.com, May 13 2017

Issue description

VULNERABILITY DETAILS
Passwords stored with Google Smart Lock are usually not readable without the root/user password. However, I found out that it is very simple to bypass this prompt for saved google account passwords:
I have saved my password for my google account. In the google chrome settings I am able to see for which account and which website (here: accounts.google.com) I have stored information, but without seeing the actual password. Anyway, as already said, clicking on "show password" prompts a window for my root password. But as I know already for which service the password is saved, I can simply go to my google login page and let Chrome filling out the form  automatically. Using the right-click->inspect function of chrome allows me to return the full-text value of the password. For details, see the reproduction case.
Unfortunately, that issue is OS independent!

VERSION
Chrome Version: 53.0.2 + stable
Operating System: Windows 10 (anyway, the bug is OS independent)

REPRODUCTION CASE
As mentioned above, go to the login of your google account and let the smart lock fill out the form. Then, simply right click and go to "inspect" and search for the corresponding html input element. Change its type from "password" to "text" and press enter and the stored password will appear in the input element. 
I have also attached a screenshot of the element.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
No crash!

 
SmartLock-Bug.png
149 KB View Download
Project Member

Comment 2 by sheriffbot@chromium.org, Aug 21 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment