# MA-569.022016: MyCERT Advisory - Comodo Chromodo Browsers Vulnerable to Cross-Domain Attacks

**Date:** 05 Feb 2016  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-569.022016  
**Advisory ID:** MA-569.022016

---

####
**1.0 Introduction**
Some Comodo Chromodo browser versions (45.8.12.392, 45.8.12.391, and possibly earlier) are vulnerable to cross-domain attacks. Comodo Chromodo browser that does not enforce same origin policy could allow for the possibility of cross-domain attacks by malicious or compromised web hosts.
Chromodo is based on an outdated release of Chromium with known vulnerabilities. Users and administrators are recommended to review Vulnerability Note VU#305096 for additional information and mitigation details.
**2.0 Impact**
These updates address vulnerabilities that could potentially allow an attacker to obtain access to web content from another domain by convincing a user to visit a specially crafted web page.
**3.0 Affected Products**
The affected lists of the Comodo Chromodo browser products updates are as below:
- Comodo Chromodo browser version 45.8.12.392
- Comodo Chromodo browser version 45.8.12.391 and possibly earlier
**4.0 Recommendation**
The following workaround is recommended:
> **4.1 Disable JavaScript**
> Disabling JavaScript may mitigate cross-domain scripting attacks. For instructions, refer to Comodo's help page:
> <https://help.comodo.com/topic-249-1-593-6747-Configuring-Settings-for-Images,-Java-Scripts-and-other-Web-Contents.html>
>
> Note: Disabling JavaScript may not protect against known vulnerabilities in the version of Chromium on which Chromodo is based. For this reason, users should prioritize implementing the following workaround.
>
> **4.2 Discontinue use**
> Until these issues are addressed, consider discontinuing use of Chromodo.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#593a203b3c2b606060193a203b3c2b2a3c3a2c2b302d20773420) or [[email protected]](/cdn-cgi/l/email-protection#bed3c7dddbcccafed3c7dddbccca90d1ccd990d3c7) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- Comodo Chromodo Browsers Vulnerable to Cross-Domain Attacks:
<https://www.us-cert.gov/ncas/current-activity/2016/02/04/Comodo-Chromodo-Browsers-Vulnerable-Cross-Domain-Attacks>
- Vulnerability Note VU#305096:
<https://www.kb.cert.org/vuls/id/305096>
- Comodo's so-called 'Secure Internet Browser' Comes with Disabled Security Features
<http://thehackernews.com/2016/02/comodo-web-browser-security.html>