Dynamics of Google, Apple and Microsoft when the browser has a security error

While Apple and Google urgently sought to patch security holes in Safari (CVE-2017-2419) and Chrome (CVE-2017-5033) browsers, Microsoft did not notice. This security vulnerability was discovered by Cisco Talos researchers in Safari, Chrome, and Edge browsers, but Microsoft believes that this security is due to design.

According to researcher Nicolai Grødum at Cisco Talos, this vulnerability is classified as a exit from CSP (Content Security Policy) - a mechanism that allows web developers to configure HTTP headers and instruct users to access Source browser (JavaScript, CSS). Content security policy (CSP) is one of the tools that browsers use to implement SOP - Same-Origin Policy within the browser.

Grødum said he found out how an attacker who bypassed CSP, downloaded malicious JavaScript code on a remote site and performed intrusion operations such as collecting information from the user's cookie or recording the syntax press key in page structure, .

Exploiting vulnerabilities is quite simple

Exploiting this vulnerability in the browser is quite simple - at least for those with a background in web development. An attacker just needs to open a new website via the '_blank' method and use the document.write function to write malicious code inside this page before downloading the actual content. Malicious content (also known as initial XSS attack code) remains and helps attackers overcome CSP protection.

Grødum found the vulnerability in November last year. This issue is ranked seriousness CVSS is 4.3 / 10.

Dynamics of Google, Apple and Microsoft when the browser has a security error Picture 1

Users of the Edge browser are easily vulnerable to this vulnerability while Google Chrome users 57.0.2987.98, iOS 10.3, and Safari 10.1 or newer are all protected. And Firefox is lucky to be unaffected.