VULNERABILITY DETAILS :

The bug allow me to inject script directly on browser active tab.
when i test it on old version of chrome browser it works.
i can run my script on any website or web application without any tool.
i try to run this code on IE,forfox. but its not working on other browsers. 

VERSION:

Chrome Version: 10.0.648.127 stable,62.0.3202.52(Official Build) beta(64-bit)
                61.0.3163 stable.
Operating System: Windows 7 Ultimate 64 bit service pack 1

REPRODUCTION CASE :

Step 1 -

open Chrome browser and log in to a web application which one you want..
for example gmail,facebook etc..

Step 2 

inject your script on an url address bar of browser with javascript: prefix.

delete the addresses from url bar and write these code and hit enter.
 
javascript:alert(document.domain);
javascript:alert(document.cookie);
javascript:alert(document.location);

any many more..

you can see your script run successfully.





 

Deleted: inject Script.png 522 KB

	inject Script.png 522 KB View Download

Deleted: outupt1.png 493 KB

	outupt1.png 493 KB View Download

Deleted: Script Inject on active Tab.png 313 KB

	Script Inject on active Tab.png 313 KB View Download

Deleted: output 2.png 265 KB

	output 2.png 265 KB View Download