The same week Microsoft announced on Jan. 26 it had put protections against clickjacking in Internet Explorer 8, security researcher Aditya Sood posted on BugTraq on Jan. 29 a new clickjacking advisory for the Google Chrome browser, with a link to a proof of concept.

Officials at Google said they are aware of the issue, which affects Chrome versions 1.0.154.43 and earlier. So far, Google says it has not seen any attempts to exploit this vulnerability in the wild. Though the posted advisory only mentions Google Chrome, there are reports that the same vulnerability affects Mozilla's Firefox 3.0.5 as well—though this can be mitigated by using the ClearClick anti-clickjacking feature contained in the NoScript plug-in for Firefox.  

Internet Explorer 7 does not seem to be affected by Sood's method.

Still, clickjacking has affected all the major browsers. The technique was publicized in 2008 by security researchers Jeremiah Grossman, CTO of WhiteHat Security, and Robert Hansen. If done successfully, clickjacking can trick users into clicking on links without their knowledge and effectively circumvents cross-site request forgery protections that attempt to confirm transactions with the user.

Read the rest of this article on eWEEK.com.