^{CVE-2017-15426:}Insufficient policy enforcement in Omnibox in Google Chrome allowed domain spoofing via IDN homographs.

Overview

This vulnerability (CWE-20: Improper Input Validation) exists in the Omnibox component of Google Chrome, which is responsible for displaying and validating URLs. The issue stems from insufficient policy enforcement when handling Internationalized Domain Names (IDNs). An attacker could register a domain using characters from non-Latin scripts that visually resemble legitimate domain names. For example, using Cyrillic characters that look like Latin letters to create "paypal.com" but with some characters replaced by visually similar non-Latin characters. When users visit these spoofed domains, the browser would display what appears to be the legitimate domain in the address bar, potentially leading to phishing attacks, credential theft, or malware distribution.

Remediation

To address this vulnerability, users and administrators should:

1. Update Google Chrome to version 63.0.3239.84 or later, which contains the fix for this vulnerability.
2. For enterprise environments, ensure that automatic updates are enabled or deploy the updated version through your organization's software management system.
3. Consider implementing additional security measures such as:
   • Using password managers that verify the actual domain (not just visual appearance)
   • Enabling two-factor authentication on sensitive accounts
   • Training users to verify website authenticity through multiple means, not just the URL appearance
4. System administrators should consider implementing DNS filtering or web proxies that can detect and block access to known phishing domains.

References

1. Chrome Release Blog announcement: https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html
2. Chrome Bug Tracker: https://crbug.com/756735
3. Red Hat Security Advisory: https://access.redhat.com/errata/RHSA-2017:3401
4. Debian Security Advisory: https://www.debian.org/security/2017/dsa-4064
5. Gentoo Linux Security Advisory: https://security.gentoo.org/glsa/201801-03