Chrome and Firefox get clickjacked

Security researchers have discovered a flaw affecting Google's Chrome browser which exposes it to clickjacking - where an attacker hijacks a browser's functions by substituting a legitimate link with one of the attacker's choice.

Google has acknowledged the flaw and is working towards a patch for Chrome versions 1.0.154.43 and earlier when running within Windows XP SP2 systems, according to SecNiche security researcher Aditya K Sood.

Sood disclosed the flaw on Tuesday and has since posted a proof of concept on the Bugtraq vulnerability disclosure forum.

The best of silicon.com photos

1. Photos: Second Life gets down to business

2. Photos: Taking the wraps off Windows 7

3. Photos: Honda kick starts motorcycle safety tech

4. Minority Report: 10 Apple patents to watch

5. Photos: Cops use tech to point the finger of suspicion

In the disclosure Sood said: "Attackers can trick users into performing actions which the users never intended to do and there is no way of tracing such actions later, as the user was genuinely authenticated on the other page."

While Google is working on a fix, a spokesperson for the Australian arm of the company pointed out that clickjacking affected all browsers, not just Chrome.

"The [clickjacking] issue is tied to the way the web and web pages were designed to work, and there is no simple fix for any particular browser. We are working with other stakeholders to come up with a standardised long-term mitigation approach," the spokesperson said.

However, independent security researcher, CEO of Australian security consultancy Novologica, Nishad Herath, told silicon.com sister site ZDNet.com.au that after running Sood's proof of concept he found that Internet Explorer 8 (release candidate 1 and beta 2 versions) and Opera 9.63 (the latest version) were not exposed to the flaw. But, like Chrome, Firefox 3.0.5 was exposed.

Google's security researchers had not found any attacks in the wild which exploited the specific vulnerability, said Google's spokesperson.

Clickjacking is a relatively new browser attack. The attack broadly fits within the category of cross-site scripting forgery, where an attacker uses maliciously crafted HTML or JavaScript code to force a victim's web browser to send an HTTP request to a website of their choosing.

Original article: Chrome, Firefox get clickjacked from ZDNet Australia