Google Chrome Pop-Up Address Bar URI Spoofing Vulnerability

Bugtraq ID:	32258
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 11 2008 12:00AM
Updated:	Nov 13 2008 06:34PM
Credit:	Liu Die Yu of the TopsecTianRongXin research lab
Vulnerable:	Google Chrome 0.2.149 .30 Google Chrome 0.2.149 .29 Google Chrome 0.2.149 .27
Not Vulnerable:	Google Chrome 0.3.154 9

Google Chrome Pop-Up Address Bar URI Spoofing Vulnerability

Google Chrome is affected by a URI-spoofing vulnerability because it fails to adequately handle user-supplied data.

An attacker may leverage this issue by inserting arbitrary content to spoof the source URI of a file presented to an unsuspecting user in a popup window. This may lead to a false sense of trust because the victim may be presented with a source URI of a trusted site while interacting with the attacker's malicious site.

Versions prior to Chrome 0.3.154.9 are vulnerable.

Google Chrome Pop-Up Address Bar URI Spoofing Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web document.

The following example exploit is available:

http://liudieyu.com/kissofthedragon.32168816196486005/

Google Chrome Pop-Up Address Bar URI Spoofing Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

Google Chrome Pop-Up Address Bar URI Spoofing Vulnerability

References:

• Google Chrome Homepage (Google)
  
• Google Chrome Releases: Beta release: 0.3.154.9 (Google)
  
• Google Chrome Break (Liu Die Yu )