Chrome HTML CSP Bypass via Crafted Page

Executive Summary

This vulnerability is an inappropriate implementation in Google Chrome's HTML handling before version 151.0.7922.72. It allows a remote attacker to bypass content security policy through a specially crafted HTML page.

Useful 0 Not Useful 0

Detection Guidance

Detection requires checking the installed version of Google Chrome. If the version is prior to 151.0.7922.72, the system is vulnerable. Use commands like 'google-chrome --version' or check via package manager (e.g., 'apt list --installed | grep chrome' for Debian-based systems).

Inspect network traffic for unusual HTML content or policy bypass attempts, though this requires deeper analysis.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to bypass security restrictions, potentially loading malicious content or executing unauthorized scripts on a user's browser session.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a remote attacker to bypass content security policy via a crafted HTML page, which could lead to unauthorized data access or manipulation. This may impact compliance with GDPR by risking unauthorized data processing and HIPAA by potentially exposing protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update Google Chrome to version 151.0.7922.72 or later immediately. Disable automatic updates temporarily if needed, but prioritize patching.

Restrict untrusted HTML content access and enforce strict content security policies (CSP) to limit potential exploitation.

Useful 0 Not Useful 0