full-disclosure - Re: [FD] Google Chrome Address Spoofing (Request For Comment)

Open Source and information security mailing list archives

Message-id: <00a801d0b412$93720ac0$ba562040$@gorski.com>
Date: Wed, 01 Jul 2015 11:28:26 -0400
From: "Mike K Gorski" <mike@...ski.com>
To: <fulldisclosure@...lists.org>
Subject: Re: [FD] Google Chrome Address Spoofing (Request For Comment)

> We reported this to Google.

> They reproduced, and say

> It's DoS which doesn't matter.

> We think it's very strange,

> since the browser does not crash(not DoS),

I think they called it DOS because the chrome.exe process starts to consume
system memory out of control.

In my example (Win7 Chrome 43.0.2357.130) it ended up consuming 4GB+ of
memory before it finally gave up 3 minutes or so later and issued an error
message in both windows.

Potentially, with multiple such frames being launched one could make it
crash.

That's beside the point though as the URL spoofing is clearly there.

--Mike

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives