CVE-2017-15426: Input Validation
An url spoof flaw was found in the Omnibox component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=756735
External References:
https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
Other sources
Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 63.0.3239.84 - Upgrade
Upgrade
Google Chrome/Chromiumto a version that resolves this vulnerability.Fixed in 63.0.3239.84
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of affected Chromium-based browsers are exposed when they visit or are directed to a crafted domain name. The issue affects Google Chrome versions before 63.0.3239.84 and is also listed for Chromium Browser packages on Debian and Red Hat Enterprise Linux systems.
What does an attacker need to exploit it?
An attacker needs to lure a user into interacting with a crafted domain using IDN homographs. No authentication or prior privileges are required, but user interaction is required.
What is the practical impact?
The attacker can spoof the displayed domain identity in the browser Omnibox, potentially making a malicious site appear to belong to a different domain. The provided CVSS vector rates integrity impact as high, with no confidentiality or availability impact.
How can the issue be remediated?
Update Google Chrome to version 63.0.3239.84 or later, and apply the applicable Chromium Browser security updates supplied by the operating system vendor.