lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 01 Jul 2015 11:28:26 -0400
From: "Mike K Gorski" <mike@...ski.com>
To: <fulldisclosure@...lists.org>
Subject: Re: [FD] Google Chrome Address Spoofing (Request For Comment)

> We reported this to Google.

> They reproduced, and say

> It's DoS which doesn't matter.

> We think it's very strange,

> since the browser does not crash(not DoS),

 

I think they called it DOS because the chrome.exe process starts to consume
system memory out of control.

In my example (Win7 Chrome 43.0.2357.130) it ended up consuming 4GB+ of
memory before it finally gave up 3 minutes or so later and issued an error
message in both windows.

Potentially, with multiple such frames being launched one could make it
crash.

That's beside the point though as the URL spoofing is clearly there.

 

--Mike


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists