Issue 150516303: Fwd: URGENT: Reward is given to wrong person: I found a bug (security vulnerability) in all browsers:

[buganize...@google.com]

Replying to this email means your email address will be shared with the team that works on this product.

https://issuetracker.google.com/issues/150516303

Reference Info: 150516303 Fwd: URGENT: Reward is given to wrong person: I found a bug (security vulnerability) in all browsers:

component:  750480
status:  New
reporter:  pi...@gmail.com
cc:  ga...@googlegroups.com, pi...@gmail.com
type:  Bug
priority:  P4
severity:  S2
retention:  Component default


pi...@gmail.com added comment #1:
Dear Sir/M'am,
Kindly forward my mail to concerned departments.
I found a bug (security vulnerability) in all browsers & reported to Microsoft Insider Program-feedback hub & Mcafee etc. Some one reported my report & copy pasted it to you & claimed REWARD. Which originally belongs to me. Above finding was originally mine but claimed by this person: 1) Out-of-limit memory access in transmissions (CVE-2020-6407) - Reported by Sergei Glazunov of Google Project Zero on 2020-01-272) Type Confusion in V8 (CVE-2020-6418) - Reported by Clement Lecigne of the Google Threat Analysis Group in 2020-02-18
*CVE-2020-6418 Description: Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.*Source: https://nvd.nist.gov/vuln/detail/CVE-2020-6418#vulnCurrentDescriptionTitle 
* Source: https://www.seguridadyfirewall.cl/2020/02/lanzan-parche-para-google-chrome-que.html
* I think that this is the CVE Number & is for the same finding originally reported by me.

Kindly Don't give reward to wrong person without thorough investigation. It was my finding of vulnerability & hence i put my claim on reward money. Kindly feel free to ask questions/inquiry. I shall co-operate. I have put my claim on that which i deserve. This will help pay my education.
Kindly visit: https://bugs.chromium.org/p/chromium/issues/detail?id=1057404 

PROOF-1: Trail of Email conversation Proves when & whom i reported the bug.
PROOF-2: Email Date tells that I was the first person to report the security vulnerability.
My Email ID: pidf...@gmail.com
Email sent to: si...@mcafee.com


VULNERABILITY DETAILS: This URL seems to run Malicious code in browser.

Detail: 1:

McAfee GTI Customer Response Team - North America Ticket History:[#IAY-120-55118]:

Client Posted On: 14 January 2020 04:42 PM
Dear Team,
This website after downloading any video opens a new tab automatically & redirects url to different sites & runs a malicious code in browser. I suspect the downloaded files also
contains malicious code.
https://www.y2mate.com/youtube/oQnqWAEReoY
Warmest regards
Prashanna
43.2 Google Analytics Create Goals & Funnel.mp4
<https://drive.google.com/file/d/18nyd_uNZCVEzzkuoTPRGzS_0WRLd4RXR/view?usp=drive_web>

. -----------------------------------.
Detail: 2 Proof:
On Wed, Jan 15, 2020 at 5:22 AM McAfee GTI Customer Response Team <si...@mcafee.com> wrote:
Dear Valued Customer,

Thank you for contacting us. This is an automated response confirming the receipt of your ticket. For your records, the details of the ticket are listed below. When replying, please make sure that the ticket ID is kept in the subject line to ensure that your replies are tracked appropriately.Please note, there is no set turn-around time for requests submitted to this email address. For quicker turn-around, please submit URLs through Trusted Source Ticketing System with your comment at the following link. Requests submitted through your registered account will be processed within 3-5 business days while some requests may take longer.For URL Submission: https://www.trustedsource.org/?p=mcafee

   Ticket ID: IAY-120-55118
   Subject: This URL seems to run Malicious code in browser

Kind regards,

McAfee GTI Customer Response Team
. ------------------------------------------- .

Detail: 3 Proof:
On Wed, Jan 15, 2020 at 9:23 AM McAfee GTI Customer Response Team <si...@mcafee.com> wrote:
Hello,

Thank you for sending this URL to us for review. Upon review, the rating will be adjusted in the next GTI Database release.

The GTI Database with this change will be available for download from our public download servers in a few hours. Depending on the download schedule for your organization, you may not see this change until a later date. Please contact your network administrator.

Sincerely,


Nicki

McAfee GTI Customer Response Team - North America
. ---------------------------------------------------- .

VERSION
Chrome Version: Version before Jan 2020.
[x.x.x.x] + [stable, beta, or dev]

Operating System: Windows 10

REPRODUCTION CASE
This website (https://www.y2mate.com/youtube/oQnqWAEReoY) after downloading any video opens a new tab automatically & redirects url to different sites & runs a malicious code in browser. I suspect the downloaded files also
contains malicious code.

CREDIT INFORMATION
Externally reported security bugs may appear in Chrome release notes. If
this bug is included, how would you like to be credited?
Reporter credit: My Name should appear "Prashanna Gotani".

Kindly Don't give reward to wrong person without thorough investigation. It was my finding of vulnerability & hence i put my claim on reward money. This will help pay my education.

Warmest regards
Prashanna Gotani
Pidf...@gmail.com


. ---------------------------------------------------------- .


Screenshot (10).png
ViewDownload

Screenshot (11).png
ViewDownload

Screenshot (12).png
ViewDownload

Screenshot (13).png
ViewDownload

Generated by Google IssueTracker notification system

You're receiving this email because you are subscribed to updates on Google IssueTracker issue 150516303. 
Unsubscribe from this issue.

[buganize...@google.com]

Replying to this email means your email address will be shared with the team that works on this product.

https://issuetracker.google.com/issues/150516303

Changed

pi...@gmail.com added comment #2:
URL to public write-up: https://docs.google.com/document/d/198OJwKZ6NQ7RieuWuG336shnnk0WkuU6G6dEzswRT9M/edit?usp=sharing

_______________________________

Reference Info: 150516303 Fwd: URGENT: Reward is given to wrong person: I found a bug (security vulnerability) in all browsers:

component:  750480
status:  New
reporter:  pi...@gmail.com
cc:  ga...@googlegroups.com, pi...@gmail.com
type:  Bug
priority:  P4
severity:  S2
retention:  Component default

[buganize...@google.com]

Replying to this email means your email address will be shared with the team that works on this product.

https://issuetracker.google.com/issues/150516303

Changed

pi...@gmail.com added comment #3:

Above finding was originally mine but claimed by this person:

    1) Out-of-limit memory access in transmissions (CVE-2020-6407) - Reported by Sergei Glazunov of Google Project Zero on 2020-01-27
    2) Type Confusion in V8 (CVE-2020-6418) - Reported by Clement Lecigne of the Google Threat Analysis Group in 2020-02-18


*CVE-2020-6418 Description: Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
*Source: https://nvd.nist.gov/vuln/detail/CVE-2020-6418#vulnCurrentDescriptionTitle
* Source: https://www.seguridadyfirewall.cl/2020/02/lanzan-parche-para-google-chrome-que.html

URL to public write-up: https://docs.google.com/document/d/198OJwKZ6NQ7RieuWuG336shnnk0WkuU6G6dEzswRT9M/edit?usp=sharing

* I think that this is the CVE Number & is for the same finding originally reported by me. Please do correction if needed.

_______________________________

Reference Info: 150516303 Fwd: URGENT: Reward is given to wrong person: I found a bug (security vulnerability) in all browsers:

component:  750480
status:  New
reporter:  pi...@gmail.com
cc:  ga...@googlegroups.com, pi...@gmail.com
type:  Bug
priority:  P4
severity:  S2
retention:  Component default

[buganize...@google.com]

Replying to this email means your email address will be shared with the team that works on this product.

https://issuetracker.google.com/issues/150516303

Changed

pi...@gmail.com added comment #4:
The hacker (Website) after downloading any video/item opens a new tab automatically & redirects url to different sites & runs a malicious code that can compromise computers.

The code gets inside in Temp folder & in RAM. When we delete temp folder, the program/malicious code is not deleted from RAM so it again gets into temp folder without getting installed in C-Drive like other applications. If we format & reinstall C-Drive from Windows OS, the code from RAM again infects temp folder.Thus it is difficult to be detected & it is also difficult to get removed.

website; https://www.y2mate.com/youtube/oQnqWAEReoY 

_______________________________

Reference Info: 150516303 Fwd: URGENT: Reward is given to wrong person: I found a bug (security vulnerability) in all browsers:

component:  750480
status:  New
reporter:  pi...@gmail.com
cc:  ga...@googlegroups.com, pi...@gmail.com
type:  Bug
priority:  P4
severity:  S2
retention:  Component default

[buganize...@google.com]

Replying to this email means your email address will be shared with the team that works on this product.

https://issuetracker.google.com/issues/150516303

Changed

jz...@google.com added comment #5:
This issue appears to deal with Chrome itself, this is the incorrect tracker for that project. Please use https://crbug.com.

_______________________________

Reference Info: 150516303 Fwd: URGENT: Reward is given to wrong person: I found a bug (security vulnerability) in all browsers:

component:  750480

status:  Infeasible

reporter:  pi...@gmail.com
cc:  ga...@googlegroups.com, pi...@gmail.com
type:  Bug
priority:  P4
severity:  S2
retention:  Component default