Ref: ZDI-CAN-5365

This bug was responsibly disclosed during pwn2own mobile 2017.

The text is provided by the reporter:

"At this point the web page is trying to perform 2 automated redirections. Firstly it tries to load the SamsungNotes app through the market place proxy ('market://details?url=content://media/external/file/350&id=com.samsung.android.app.no tes'). This causes the parsing of the memo file and writing of the configuration to the external storage. Secondly the reboot URL is visited. 

These two actions constitute two automated actions, which is not permitted by Chrome. Chrome permits one automated action (such as Javascript updating the ‘document.location’ value), but this must then be followed by an actual user action (such as the user tapping a link on the screen) before another automated action can take place. It was found that enforcement of this rule was not strict, and enabled two automated actions to take place in the initial moments after a page had loaded. Therefore the HTML’s body’s ‘onLoad’ function was set to click on an anchor element containing the reboot URL, and then immediately click on another anchor element linking to the memo. This had the effect of triggering both activities, even though only one should be triggered."

See the true branch of "if (sessionStorage.getItem("memo")) {" in downloadme.html
 

Deleted: downloadme.html 4.0 KB

downloadme.html 4.0 KB View Download