Chromium Copy-Paste XSS Vulnerability Reproduction Steps

Critical Vulnerability Information Overview Vulnerability Type: XSS (Cross-Site Scripting) Description: A universal XSS vulnerability triggered by copy-paste operations, where users copying content from untrusted sites and pasting it into trusted sites may trigger an XSS attack. Background Related Vulnerabilities: This vulnerability is associated with the following two issues: - crbug.com/chromium/1065761 - crbug.com/chromium/1011950 For detailed information, see: the-curious-case-of-copy-paste Vulnerability Details Vulnerability Details When a user copies a specific HTML snippet from an untrusted site and pastes it into a trusted site, it may lead to an XSS attack. A proof-of-concept (PoC) demonstration is provided to show how to reproduce the vulnerability. Demonstration Steps 1. Visit the demo website. 2. Paste the specified HTML fragment into the left text area. 3. Copy the HTML to the clipboard. 4. Enter some content in the right text area, such as "abc". 5. Place the cursor at the beginning of the right text area (before "abc"). 6. Paste the content from the clipboard (Ctrl/Cmd+V). 7. Click the reload button on the page. 8. XSS is triggered. Vulnerability Status Priority: P1 Severity: S2 Status: Fixed Related Tags: Indicate that the issue has been acknowledged and addressed. Reporter and Handler Reporter: mi...@bentkowski.info Handler: you...@chromium.org

Goal Reached Thanks to every supporter — we hit 100%!

Chromium Copy-Paste XSS Vulnerability Reproduction Steps