First blog post in a long time, so firstly I apologise for that.


I was looking for a companies contact number to report a bug to them using my phone which is when I discovered this extremely weird bug.

So for my testing I have only tried on an Iphone 5 running iOS 8.0.2 only the current Chrome browser version.


Exploit Landscape:
Chrome includes a feature called "Click-To-Call". I made my call using this feature (yes, opsec fail i know) and you get a message prompt confirming if you wish to make the call or cancel it.

Exploit Technique:
Simply pressing cancel instead of confirm pushes the call through anyway, leaving the user unable to decline a call, at least for a few seconds.

How can this be abused?
A malicious attacker could exploit this by embedding the Click-To-Call code in a malicious web page that then leaves the user with a call they can not decline. Blackhats can profit from this by entering a premium call affiliate and sending their malicious website to unsuspecting users.