VULNERABILITY DETAILS
XSS in URL bar

VERSION
Chrome Version: [71.0.3578.98] + Version 71.0.3578.98 (Official Build) (64-bit)
Operating System: MacOS Mojave 10.14.2

REPRODUCTION CASE
Open Chrome Browser
Insert the following javascript "javascript:alert(1)" in the URL bar.
Once you enter the word "javascript" is deleted, but you can write it directly again and the browser wont delete it
(see screenshot_1_xss)

press ENTER

RESULT
The alert pops out (see screenshot_2)


CREDIT INFORMATION
Externally reported security bugs may appear in Chrome release notes. If
this bug is included, how would you like to be credited?
Reporter credit: johanna curiel

 

Deleted: screenshot_1_xss.png 85.3 KB

	screenshot_1_xss.png 85.3 KB View Download

Deleted: screenshot_2.png 183 KB

	screenshot_2.png 183 KB View Download