Google Chrome Popup Blocker Security Bypass Vulnerability

Bugtraq ID:	47966
Class:	Access Validation Error
CVE:	CVE-2011-1801
Remote:	Yes
Local:	No
Published:	May 24 2011 12:00AM
Updated:	Mar 19 2015 09:17AM
Credit:	Chamal De Silva
Vulnerable:	SRWare Iron 11.0.700.2 SRWare Iron 11.0.700.1 SRWare Iron 11.0.700.0 Google Chrome 9.0.597.94 Google Chrome 9.0.597.84 Google Chrome 9.0.597.107 Google Chrome 8.0.552.344 Google Chrome 8.0.552.310 Google Chrome 8.0.552.309 Google Chrome 8.0.552.308 Google Chrome 8.0.552.307 Google Chrome 8.0.552.306 Google Chrome 8.0.552.305 Google Chrome 8.0.552.304 Google Chrome 8.0.552.303 Google Chrome 8.0.552.302 Google Chrome 8.0.552.301 Google Chrome 8.0.552.300 Google Chrome 8.0.552.237 Google Chrome 8.0.552.226 Google Chrome 8.0.552.225 Google Chrome 8.0.552.224 Google Chrome 8.0.552.223 Google Chrome 8.0.552.222 Google Chrome 8.0.552.221 Google Chrome 8.0.552.220 Google Chrome 8.0.552.219 Google Chrome 8.0.552.218 Google Chrome 8.0.552.217 Google Chrome 8.0.552.216 Google Chrome 8.0.552.215 Google Chrome 8.0.552.214 Google Chrome 8.0.552.213 Google Chrome 8.0.552.212 Google Chrome 8.0.552.211 Google Chrome 8.0.552.210 Google Chrome 8.0.552.21 Google Chrome 8.0.552.209 Google Chrome 8.0.552.208 Google Chrome 8.0.552.207 Google Chrome 8.0.552.206 Google Chrome 8.0.552.205 Google Chrome 8.0.552.204 Google Chrome 8.0.552.203 Google Chrome 8.0.552.202 Google Chrome 8.0.552.201 Google Chrome 8.0.552.200 Google Chrome 8.0.552.20 Google Chrome 8.0.552.2 Google Chrome 8.0.552.19 Google Chrome 8.0.552.18 Google Chrome 8.0.552.17 Google Chrome 8.0.552.16 Google Chrome 8.0.552.15 Google Chrome 8.0.552.14 Google Chrome 8.0.552.13 Google Chrome 8.0.552.12 Google Chrome 8.0.552.11 Google Chrome 8.0.552.105 Google Chrome 8.0.552.104 Google Chrome 8.0.552.103 Google Chrome 8.0.552.102 Google Chrome 8.0.552.101 Google Chrome 8.0.552.100 Google Chrome 8.0.552.10 Google Chrome 8.0.552.1 Google Chrome 8.0.552.0 Google Chrome 8.0.551.1 Google Chrome 8.0.551.0 Google Chrome 8.0.550.0 Google Chrome 8.0.549.0 Google Chrome 11.0.696.68 Google Chrome 11.0.696.65 Google Chrome 11.0.696.57 Google Chrome 11.0.696.43 Google Chrome 11.0.672.2 Google Chrome 11 Google Chrome 10.0.648.205 Google Chrome 10.0.648.205 Google Chrome 10.0.648.204 Google Chrome 10.0.648.133 Google Chrome 10.0.648.128 Google Chrome 10.0.648.127 Google Chrome 10.0.648.127 Google Chrome 10
Not Vulnerable:	SRWare Iron 11.0.700.3 Google Chrome 11.0.696.71

Google Chrome Popup Blocker Security Bypass Vulnerability

Google Chrome is prone to a security-bypass vulnerability.

An attacker may leverage this issue to bypass intended security restrictions to open arbitrary pop-up windows, which may lead to further attacks.

Google Chrome Popup Blocker Security Bypass Vulnerability

To exploit this issue, an attacker must entice a victim into visiting a malicious page.

Google Chrome Popup Blocker Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Google Chrome Popup Blocker Security Bypass Vulnerability

References:

• Google Chrome Homepage (Google)
  
• New Iron-Version: 11.0.700.3 Stable for Windows (SRWare)
  
• Stable Channel Update 11.0.696.71 (Google)