Google Chrome 'About:blank' Address Bar URI Spoofing Vulnerability

Bugtraq ID:	35839
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 28 2009 12:00AM
Updated:	Jul 28 2009 07:55PM
Credit:	Lostmon
Vulnerable:	Google Chrome 2.0.172 .37 Google Chrome 2.0.172 .33 Google Chrome 2.0.172 .31 Google Chrome 2.0.172 .30
Not Vulnerable:

Google Chrome 'About:blank' Address Bar URI Spoofing Vulnerability

Google Chrome is affected by a URI-spoofing vulnerability.

An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be presented with a URI of a seemingly trusted site while interacting with the attacker's malicious site.

Chrome 2.0.172.37 is vulnerable; other versions may also be affected.

This issue is similar to the vulnerabilities discussed in BID 35803 (Mozilla Firefox Error Page Address Bar URI Spoofing Vulnerability) and BID 35829 (Apple Safari Error Page Address Bar URI Spoofing Vulnerability).

Google Chrome 'About:blank' Address Bar URI Spoofing Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to view a maliciously crafted web document.

The following example is available:

• /data/vulnerabilities/exploits/35839.html

Google Chrome 'About:blank' Address Bar URI Spoofing Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Google Chrome 'About:blank' Address Bar URI Spoofing Vulnerability

References:

• Google Chrome About:blank spoof (Lostmon)
  
• Google Chrome Homepage (Google)
  
• Google Chrome About:blank spoof (Lostmon lords )