Georg Felber

The issue exists due to inadequate protection of web page structure when handling html and body tags. This could allow a remote attacker to gain unauthorized access to protected information. An attacker could use markup injection to steal nonce values, potentially bypassing strict content security policies.

A logic issue was addressed with improved state management. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

An injection issue was addressed with improved validation. A maliciously crafted webpage may be able to fingerprint the user. The issue is related to the disclosure of information and may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service using a specially crafted webpage.

The issue is related to an inappropriate implementation in the Content Security Policy (CSP) mechanism of Google Chrome, allowing a remote attacker to bypass existing security restrictions using a specially crafted HTML page. This could potentially lead to security policy violations. The estimated number of affected devices and real-world incidents are not specified.