CVE-2017-15394 PoC — Google Chrome for Mac、Windows和Linux Extensions 安全漏洞

Source

https://github.com/sudosammy/CVE-2017-15394

Associated Vulnerability

Title:Google Chrome for Mac、Windows和Linux Extensions 安全漏洞 (CVE-2017-15394)
Description:Insufficient Policy Enforcement in Extensions in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to perform domain spoofing in permission dialogs via IDN homographs in a crafted Chrome Extension.

Readme

# CVE-2017-15394

>A URL spoofing flaw has been found in the extensions UI of the Chromium browser < 62.0.3202.62.

An IDN homograph attack demo in Chromium through extensions.

1) Load unpacked extension into Chrome
2) View extension details and observe lack of punycode

## Impact

An attacker would leverage this weakness to aid in deception attacks by coercing a victim into granting the extension permissions to an unexpected domain.

## Patch

Released October 17, 2017: <https://chromereleases.googleblog.com/2017/10/stable-channel-update-for-desktop.html>

File Snapshot


 [4.0K]  /data/pocs/73bbca1989f0e8501e231dd64b72a2261470215b
├── [ 316]  manifest.json
└── [ 563]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!