Re: Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability.

From: Michal Zalewski <lcamtuf@coredump.cx>
To: Aditya K Sood <adi_ks@secniche.org>
Cc: bugtraq@securityfocus.com,submissions@packetstormsecurity.org,vuln@secunia.com,submit@securiteam.com
Subject: Re: Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability.
Date:


Hello Aditya,

> http://www.secniche.org/gcr_clkj

1) It is by now well-understood that because of the inherent and
broadly depended on properties of HTML, every sufficiently featured
browser is and likely will remain susceptible to the behavior known as
clickjacking. A more thorough analysis, also covering Chrome, is
provided here:

http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing)

2) To my best knowledge, the proof of concept provided in your post,
where a same-origin <div> follows a mouse pointer, is not a valid
demonstration of the issue at hand.

Regards,
/mz





Copyright © 1995-2019 LinuxRocket.net. All rights reserved.