Chrome Local NTP Extension Privilege Escalation via Script Interception

Key Information Vulnerability Title Security: Extensions can run code in the local/instant NTP Issue Description Chrome Version: 63.0.3239.108 Issue: Chrome extensions can intercept script requests and execute JavaScript code within the local NTP page (chrome-search://local-ntp/local-ntp.html). This page is a privileged page with the following capabilities: - Can input text in the Omnibox - Can steal focus (even when other applications are in focus) - Can query and manipulate browsing history (most visited sites) Reproduction Steps 1. Load the attached extension (this will open the local NTP). Expected Result A new tab opens with normal page content displayed. Actual Result A new tab opens, but the page content continuously spins, the Omnibox keeps updating, and focus is repeatedly stolen from other applications. Exploitation Details The local NTP loads a script from chrome-search://local-ntp/one-google.js and uses the result to inject additional HTML, scripts, and CSS into the page. Extensions can intercept this request in some way and execute arbitrary scripts within the NTP, thereby abusing its privileges. Reference Links local_ntp.js OneGoogleBarFetcherImpl Status Type: Vulnerability Priority: P2 Severity: S3 Status: Fixed

Goal Reached Thanks to every supporter — we hit 100%!

Chrome Local NTP Extension Privilege Escalation via Script Interception