New issue
Advanced search Search tips

Issue 807654 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Jan 2018
Cc:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

https://chromium.com/%2500 can steal password

Reported by ajithz...@gmail.com, Jan 31 2018

Issue description

This template is ONLY for reporting security bugs. If you are reporting a
Download Protection Bypass bug, please use the "Security - Download
Protection" template. For all other reports, please use a different
template.

Please READ THIS FAQ before filing a bug: https://chromium.googlesource.com
/chromium/src/+/master/docs/security/faq.md

Please see the following link for instructions on filing security bugs:
https://www.chromium.org/Home/chromium-security/reporting-security-bugs

NOTE: Security bugs are normally made public once a fix has been widely
deployed.

VULNERABILITY DETAILS:https://chromium.com/%2500 this URL can crash chrome and steal data .attackers can missuse this .i tried this on other browsers they showing error only but in  chrome attacker can steal data 

VERSION
Chrome Version: + 64.0.3282.123
Operating System:android 7.0.0 [Please indicate OS, version, and service pack level]

REPRODUCTION CASE:https://chromium.com/%2500 just go to this link and we can reproduce it.
(Please include a demonstration of the security bug, such as an attached
HTML or binary file that reproduces the bug when loaded in Chrome. PLEASE
make the file as small as possible and remove any content not required to
demonstrate the bug.)

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash:chrome  URL crash and it can steal data and passwords. [tab, browser, etc.]
Crash State:https://chromium.com/%2500 this is the crash URL
Client ID (if relevant): ajithzawz@gmail.com[see link above]

 
Screenshot_20180131-210318.png
88.3 KB View Download

Comment 1 Deleted

 Issue 807656  has been merged into this issue.
This URL neither crashes Chrome nor steals their data. As noted in your report an hour ago, it has a misconfigured certificate that results in a certificate error page.

Please provide specific details of wny you think this site "steals" anything?
Cc: elawrence@chromium.org
Status: WontFix (was: Unconfirmed)
Project Member

Comment 5 by sheriffbot@chromium.org, May 10 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment