Executive brief
A vulnerability in the Google Chrome web browser allowed malicious scripts to be executed if a user was tricked into dragging and dropping a specific link into their address bar. This could allow an attacker to perform actions on behalf of the user on the currently open website, potentially leading to the theft of session information or unauthorized data access. Users are protected by updating to the latest version of the browser.
Technical details
A vulnerability exists in the Blink rendering engine of Google Chrome and Chromium where 'javascript:' URLs are executed in the context of the current tab when dragged and dropped into the address bar (Omnibox). This flaw allows for a limited Cross-Site Scripting (XSS) attack. While the attack requires significant user interaction (social engineering to perform the drag-and-drop action), it bypasses expected security boundaries by executing script in the origin of the active page. The issue was addressed in version 55.0.2883.75 by preventing the automatic execution of such URLs through this specific UI interaction.
Affected products
- Google Chrome Prior to 55.0.2883.75
- Google Chromium Prior to 55.0.2883.75
Timeline
- 2016-12-01: advisory: Google released Chrome 55.0.2883.75 to the stable channel
- 2016-12-05: patched: Gentoo released updated Chromium packages
- 2016-12-07: patched: Red Hat released updated chromium-browser packages
- 2017-01-19: disclosed: NVD published the CVE record