Issue metadata
Sign in to add a comment
|
Security: Near homograph URL spoofing via latin small letter a with dot below (U+1EA1)
Reported by
tahir.vb...@gmail.com,
May 20 2017
|
||||||||||||||||||||||||||
Issue descriptionNOTE: Security bugs are normally made public once a fix has been widely deployed. VULNERABILITY DETAILS Hi I found and very critical security vulnerability in chrome Desktop and android mobile browser platform. vulnerability is very simple and critical. VERSION. In this vulnerability If User Type or click special crafted url in address bar then it will redirect to fake phishing website but on chrome address bar, URL of the website will exactly URL of original website. Chrome Version: 58.0.3029.110 Operating System: Windows 7 Chrome Version: 57.0.2987.132 Operating System: Android 5.1.1 REPRODUCTION CASE: To Reproduce this case For example attacker send this URL to Victim: http://xn--whatspp-en4c.com if user click on this, it will goes to fake website and Browser address bar will show real whatsapp.com url but website is not actually whatsapp.com. I also attached the videos for both android and windows
,
May 20 2017
,
May 20 2017
Sorry I did not get it you are saying? Are you requiring more information?
,
May 22 2017
Same as Issue 703750 (only a different character; this uses U+1EA1 whereas that uses U+1E43). Note: If reporting a spoofing vulnerability, if you are the owner of the spoof site, it is best if you put up a simple page explaining that this is not a real site, rather than attempting to copy the appearance of the legitimate site. We will still recognise the spoofing possibility, and you avoid the risk of actually deceiving people.
,
Aug 28 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Nov 8
|
|||||||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||||||
Comment 1 by tahir.vb...@gmail.com
, May 20 2017