Hello Chrome Security Team,

Today I want to report a vulnerability in javascript injection which might be vulnerable to display Cookie or Simply XSS by just using javascript in url.

So, We know that 
<script>alert(document.cookie)</script> or other payloads doesn't display any cookie in the popup,rather it's going to display Blank popup.
So chrome XSS prevention system always prevent to display cookies from domain.

But there is a way,which I can successfully display cookies from any domains.

Step to reproduce the vulnerability

1)Visit website like google,gmail or any page.

2)After visiting,just remove all the URL address and type javascript:alert(document.cookie) or you can type javascript:confirm(document.cookie).

3)It's going to popup with cookie values from the domain.

Now,if a person is already logged in Chrome,just type javascript:alert(document.cookie) or javascript:confirm(document.cookie) in chrome main page and Page will popup with Cookie values of Google account.

Please patch it as early as possible in chrome.

"Cookies are always the main concern."

With Regards

Kunal Pandey

Attaching With POC.rar file 

 (Operating System- Windows 8.1 64 bit

Chrome Version 63.0.3239.84 (Official Build) (64-bit) )

 

Deleted: Chromebug.rar 673 KB

Chromebug.rar 673 KB Download