Google Chrome 'javascript:' URI in 'Refresh' Header Cross-Site Scripting Vulnerability

Bugtraq ID:	35572
Class:	Input Validation Error
CVE:	CVE-2009-2352
Remote:	Yes
Local:	No
Published:	Jul 03 2009 12:00AM
Updated:	Apr 13 2015 09:09PM
Credit:	MustLive
Vulnerable:	Google Chrome 0.3.154 9 Google Chrome 0.2.149 .30 Google Chrome 0.2.149 .29 Google Chrome 0.2.149 .27 Google Chrome 1.0.154.48 Google Chrome 1.0.154.46 Google Chrome 1.0.154.36
Not Vulnerable:

Google Chrome 'javascript:' URI in 'Refresh' Header Cross-Site Scripting Vulnerability

Google Chrome is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the context of the user running the application and to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks.

Chrome 1.0.154.48 is vulnerable; other versions may also be affected.

Google Chrome 'javascript:' URI in 'Refresh' Header Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious webpage.

The following example data is available:

• /data/vulnerabilities/exploits/mustlive-browser.txt

Google Chrome 'javascript:' URI in 'Refresh' Header Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Google Chrome 'javascript:' URI in 'Refresh' Header Cross-Site Scripting Vulnerability

References:

• Google Chrome Homepage (Google)
  
• Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Ch ("MustLive" )
  
• Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera an (Michal Zalewski )