Chromium iframe -webkit-box-reflect Out-of-Bounds Painting Vulnerability

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability Description: - Title: Chromium illegally paints outside of iframe when using -webkit-box-reflect - Description: Chromium illegally paints content outside the iframe when using -webkit-box-reflect. 2. Vulnerability Type: - Type: Vulnerability 3. Priority: - Priority: P2 (Minor) 4. Severity: - Severity: S2 (Medium) 5. Status: - Status: Duplicate of 40071326 (Marked as duplicate) 6. Reporter: - Reporter: pr...@gmail.com 7. Vulnerability Files: - File: parent.html - File: iframe.html - File: ref.png 8. Reproduction Steps: - 1. Open "parent.html" in Chrome 89.0.4389.90 (official stable release). - 2. Download "iframe.html" and load it using JavaScript code. - 3. Prepare iframe('iframe.html'); - 4. This will embed the iframe and import its content into "parent.html". - 5. Expected behavior: The iframe's content should not be painted outside the iframe. - 6. Actual behavior: The iframe's content is painted outside the iframe (as shown in ref.png). 9. Browser and Operating System Versions: - Browser: Chrome 89.0.4389.90 - Operating System: Linux x86_64 - OS Version: 18.04 10. Additional Information: - CVE Description Submission: Submitted - Reward Status: In progress This information helps understand the nature of the vulnerability, reproduction steps, and the affected environment.

Goal Reached Thanks to every supporter — we hit 100%!

Chromium iframe -webkit-box-reflect Out-of-Bounds Painting Vulnerability