Issue metadata
Sign in to add a comment
|
Security: Dragging and dropping URLs leads to address bar spoofing(CVE-2017-5417)
Reported by
vladimir...@gmail.com,
May 26 2018
|
||||||||||||||||||||||
Issue description
VULNERABILITY DETAILS
CVE-2017-5417("Dragging and dropping URLs leads to address bar spoofing
") is reproducible in Chrome.
Link to bug in mozilla bug tracker: https://bugzilla.mozilla.org/show_bug.cgi?id=791597
VERSION
Chrome Version: 66.0.3359.181 stable
Operating System: OS X 10.13.4
REPRODUCTION CASE
There is a PoC from Mozilla bug tracker: http://lcamtuf.coredump.cx/urldrag/ that is attached to this report.
According to the PoC: page shows hidden layout block on `onbeforeunload` hook during navigation to unaccessible address (accounts.google.com:1234).
,
May 28 2018
This is an exact duplicate of Issue 149873 , in which it was decided not to do anything. (Having said that, visually the spoof is pretty good, although the user-interaction requirement is a rather unrealistic).
,
May 30 2018
|
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, May 27 2018