A vulnerability was found in Google Chrome 1.0.154.43 (Web Browser). It has been classified as problematic. This is going to have an impact on integrity. The summary by CVE is:

** DISPUTED ** Google Chrome 1.0.154.43 allows remote attackers to trick a user into visiting an arbitrary URL via an onclick action that moves a crafted element to the current mouse position, related to a "Clickjacking" vulnerability. NOTE: a third party disputes the relevance of this issue, stating that "every sufficiently featured browser is and likely will remain susceptible to the behavior known as clickjacking," and adding that the exploit code "is not a valid demonstration of the issue."

The weakness was presented 01/30/2009 as confirmed posting (Bugtraq). It is possible to read the advisory at securityfocus.com. This vulnerability is uniquely identified as CVE-2009-0374 since 01/30/2009. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are unknown but a public exploit is available.

A public exploit has been developed by x0x and been published even before and not after the advisory. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $25k-$100k. The real existence of this vulnerability is still doubted at the moment.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at chrome.google.com.

The vulnerability is also documented in the vulnerability database at Exploit-DB (7903). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Google

Name

• Chrome

Version

• 1.0.154.43

License

• free

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion