Chrome Universal XSS by intercepting a UA shadow tree(CVE-2016-5204)

VULNERABILITY DETAILS

When an event is dispatched to an element in a SVG shadow tree, the Event::currentTarget returns the original corresponding node, but the Event::target doesn’t make any attempt to redirect access. Therefore, the tree can be trivially leaked like this:

<svg> <g id="a"> <image href="" onerror="if (event. currentTarget !== event. target) {alert(event. target. parentNode. parentNode)}"> </g> <use href="#a"> </svg>

Gaining access to the internal shadow tree allows an attacker to manipulate it in a way that allows triggering focus events in theoretically impossible circumstances, which may lead to the DOM tree corruption.

VERSION

Chrome 52.0.2743.82 (Stable)
Chrome 52.0.2743.82 (Beta)
Chrome 53.0.2785.21 (Dev)
Chromium 54.0.2806.0 (Release build compiled today)

Attachment: exploit.zip