VULNERABILITY DETAILS
Chromium Command Line APIs are available to all Functions invoked by DevTools. Once the functions have been invoked, they can create global references to methods such as `copy` & `inspect`. This allows the following -

 - Command Line API methods can be called an infinite amount of times, outside of the initial DevTools command context.
 - Data can be repeatedly copied to the clipboard without permission - even when the window is not in focus
 - Calling the inspect API repeatedly can:
   - Prevent the ability to switch Console tabs
   - Keep the browser window in the foreground - allowing pop-unders

VERSION
Chrome Version: 66.0.3359.33

REPRODUCTION CASE
See the attached HTML file for some demos
1. Create a function accessible from inside DevTools (or override commonly used commands inside DevTools such as `console.log`)
2. That function now has access to all of the Command Line APIs - https://developers.google.com/web/tools/chrome-devtools/console/command-line-reference
 

Deleted: demo.html 1.4 KB

demo.html 1.4 KB View Download