xss on the browser google chrome
Reported by
vers...@gmail.com,
Nov 2 2017
|
|||||
Issue description
hi am li0n hrB from ksa and i found vuln on browser google chrome
1 search google images
2 open image in new tab
3 if the image url started by data:text/html
remove the url and write this payload
data:text/html,<script>function y(){x=open('parent-tab://google.com','_top'),x.document.body.innerHTML='};setTimeout(y,100)</script> <script> function Pew(){var doc=open('parent-tab://apple.com');doc.document.body.innerHTML=;}</script><button onclick=Pew();>'"><img src=x onerror=alert(document.domain)></button>
good louk
,
Nov 6 2017
Hi! Honestly, I don't understand the exploit you're trying to demonstrate. Does the `parent-tab:` scheme have special behavior in Chrome? That would be surprising. It looks like you're able to navigate to a `data:` URL, and ask that document to alert it's `document.domain`, which is the empty string due to `data:` being an opaque origin. That seems like the expected behavior? Can you help me understand the bug?
,
Nov 6 2017
,
Nov 6 2017
1 [image: صورة مضمّنة 1] 2 open image in new tab [image: صورة مضمّنة 2] 3 remove url [image: صورة مضمّنة 3]
,
Nov 6 2017
data:text/html,<script>function
y(){x=open('parent-tab://google.com','_top'),x.document.body.innerHTML='<img/src=""onerror="alert(document.cookie)">'};setTimeout(y,100)</script>
<script> function Pew(){var
doc=open('parent-tab://apple.com');doc.document.body.innerHTML=';}</script><button
onclick=Pew();>pwd<img src=x onerror=alert(document.domain)></button>
بتاريخ 6 نوفمبر، 2017 10:21 م، جاء من سعد طلق <versx39@gmail.com>:
,
Nov 10 2017
,
Nov 20 2017
What I see here is basically the same issue as: https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Does-entering-JavaScript_URLs-in-the-URL-bar-or-running-script-in-the-developer-tools-mean-there_s-an-XSS-vulnerability. A user running script via the omnibox or the developer tools is not a vulnerability in Chrome. Instead of running the script via a JavaScript URL, however, this issue instead shows running the script by loading an HTML document contained in a data URL. A HTML document loaded from a data URL is allowed to execute script, and does so as reflected in your screenshot. This does not represent a security vulnerability in Chrome.
,
Nov 30 2017
Issue 789915 has been merged into this issue.
,
May 4 2018
Issue 839864 has been merged into this issue. |
|||||
►
Sign in to add a comment |
|||||
Comment 1 by ajha@chromium.org
, Nov 3 2017Components: Blink>SecurityFeature
Labels: Needs-Milestone TE-NeedsTriageHelp
1.1 MB
1.1 MB View Download
45.6 KB
45.6 KB View Download