Bugtraq mailing list archives
Re: Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability.
From: Michal Zalewski <lcamtuf () coredump cx>
Date: Thu, 29 Jan 2009 00:40:40 +0100
Hello Aditya,
http://www.secniche.org/gcr_clkj
1) It is by now well-understood that because of the inherent and broadly depended on properties of HTML, every sufficiently featured browser is and likely will remain susceptible to the behavior known as clickjacking. A more thorough analysis, also covering Chrome, is provided here: http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing) 2) To my best knowledge, the proof of concept provided in your post, where a same-origin <div> follows a mouse pointer, is not a valid demonstration of the issue at hand. Regards, /mz
Current thread:
- Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability. Aditya K Sood (Jan 28)
- Re: Advisory: Google Chrome 1.0.154.43 ClickJacking Vulnerability. Michal Zalewski (Jan 29)