Chrome CVE-2019-13711: Cross-context Data Leak via Debug Console Utilities

Vulnerability Details: When using debug/monitor console utility functions, users can enter the debugger upon calling specific functions, or monitor function calls. When any of these utility functions is called, the process of setting debug breakpoints ultimately leads to data being shared between different contexts on the page. This allows code running in one context to access and modify objects within another context. Version Information: - Chrome Version: Tested on 75.0.3770.142 (Stable) and 77.0.3858.0 (Canary) - Operating System: Windows 10 Pro, Version 1903 Reproduction Steps: 1. Install an additional extension (composed of manifest.json and content_script.js). This extension does nothing in this case. If you already have an extension installed that runs content scripts on HTTP sites, you do not need to install it. 2. Another additional file (index.html) forms a simple website. Download this file and place it in a directory. 3. In the directory where index.html was downloaded, run the following command in the terminal: 4. Navigate in the browser to: 5. Open the Developer Console. In the main thread context, execute the following command: This function contains the following code: 6. Use the JavaScript context dropdown menu to switch to the extension context and run the following command: This should not be set, as the command is being run in the extension context. However, the variable (set in the main thread context) is set and printed in the console. CVE Identifier: CVE-2019-13711

Goal Reached Thanks to every supporter — we hit 100%!

Chrome CVE-2019-13711: Cross-context Data Leak via Debug Console Utilities