Google Chrome HTML5 information exposure

Summaryinfo

A vulnerability described as problematic has been identified in Google Chrome. This affects an unknown part of the component HTML5 Handler. Such manipulation leads to information exposure. Additionally, an exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Google Chrome (Web Browser) (unknown version). Affected by this issue is an unknown code block of the component HTML5 Handler. The manipulation with an unknown input leads to a information exposure vulnerability. Using CWE to declare the problem leads to CWE-203. The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not. Impacted is confidentiality.

The weakness was released 06/05/2014 by Paul Stone with Context Information Security as Pixel Perfect Timing Attacks with HTML5 as confirmed paper (Website). The advisory is available at contextis.com. The public release was coordinated with the vendor. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project. The advisory points out:

This paper describes a number of timing attack techniques that can be used by a malicious web page to steal sensitive data from a browser, breaking cross-origin restrictions. The new requestAnimationFrame API can be used to time browser rendering operations and infer sensitive data based on timing data. The first technique allows the browser history to be sniffed by detecting redraw events. The second part of the paper shows how SVG filters are vulnerable to a timing attack that can be used to read pixel values from a web page. This allows pixels from cross-origin iframes to be read using an OCR-style technique to obtain sensitive data from websites.

A public exploit has been developed by Paul Stone in HTML and been published immediately after the advisory. The exploit is available at contextis.com. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at chrome.google.com.

arstechnica.com is providing further details. Entries connected to this vulnerability are available at VDB-13465 and VDB-13464. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Web Browser

Vendor

• Google

Name

• Chrome

License

• free

Website

• Vendor: https://www.google.com/
• Product: https://www.google.com/chrome/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion