Google Chrome 'chromehtml:' Protocol Handler Same Origin Policy Bypass Vulnerability

Bugtraq ID:	34704
Class:	Design Error
CVE:	CVE-2009-1340 CVE-2009-1412 CVE-2009-1413 CVE-2009-1414
Remote:	Yes
Local:	No
Published:	Apr 23 2009 12:00AM
Updated:	May 06 2009 08:56PM
Credit:	Roi Saltzman
Vulnerable:	Google Chrome 0.3.154 9 Google Chrome 0.2.149 .30 Google Chrome 0.2.149 .29 Google Chrome 0.2.149 .27 Google Chrome 1.0.154.55 Google Chrome 1.0.154.48 Google Chrome 1.0.154.46 Google Chrome 1.0.154.36
Not Vulnerable:	Google Chrome 1.0.154.59

Google Chrome 'chromehtml:' Protocol Handler Same Origin Policy Bypass Vulnerability

Google Chrome is prone to a vulnerability that allows attackers to bypass the same-origin policy and obtain sensitive information, including the existence of local files and authentication credentials for web applications. Other attacks are also possible.

Google Chrome 1.0.154.55 and prior versions are vulnerable.

Google Chrome 'chromehtml:' Protocol Handler Same Origin Policy Bypass Vulnerability

To exploit this issue, an attacker must entice a victim to follow a malicious URL in Internet Explorer.

Google Chrome 'chromehtml:' Protocol Handler Same Origin Policy Bypass Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

Google Chrome 'chromehtml:' Protocol Handler Same Origin Policy Bypass Vulnerability

References:

• Google Chrome Homepage (Google)
  
• Google Chrome Universal XSS Vulnerability (Roi Saltzman)
  
• Issue 9860: ChromeHTML URI handler vulnerability (Google)
  
• CVE-2009-1412 ChromeHTML protocol handler same-origin bypass (Google)