Chrome DevTools Cross-Origin Property Disclosure via Debugger (P1/S2)

Key Information Vulnerability Details Vulnerability Description: - When using the "with" statement to operate on cross-origin objects (particularly when related cross-origin frames are in the same renderer), the DevTools debugger displays the object's properties, even if the debugged frame lacks access permissions. - These properties may be passed through custom formatters set on the page, allowing the debugger to potentially crash when using the "debugger" statement, thereby enabling access to these properties. - Even without custom formatters enabled, users can manually expand certain cross-origin properties (especially arrays). Tested Versions Chrome Version: - Tested on 76.0.3809.132 (Stable) and 78.0.3893.0 (Canary) Operating System: Windows 10 Pro, Version 1903 Reproduction Steps 1. Enable custom formatters in DevTools settings. 2. Download and place file1.html and file2.html in the same directory. 3. Open file1.html in the browser and launch DevTools. This page contains a cross-origin iframe (file2.html) and sets the following timer: 4. The debugger will break shortly after opening, at which point the content of the cross-origin window will be displayed in the debugger’s scope panel, and window properties will be passed through the custom formatter set by file1.html. 5. As described above, even without custom formatters enabled, users can manually expand array properties of cross-origin data. Additional Information Status: Fixed Priority: P1 Severity: S2 Reporter: de...@gmail.com Assigned To: bm...@chromium.org and other collaborators

Goal Reached Thanks to every supporter — we hit 100%!

Chrome DevTools Cross-Origin Property Disclosure via Debugger (P1/S2)