Re: Google Chrome Address Spoofing (Request For Comment)

["Mike K Gorski" <mike () gorski com>]

> We reported this to Google.

> They reproduced, and say

> It's DoS which doesn't matter.

> We think it's very strange,

> since the browser does not crash(not DoS),

 

I think they called it DOS because the chrome.exe process starts to consume
system memory out of control.

In my example (Win7 Chrome 43.0.2357.130) it ended up consuming 4GB+ of
memory before it finally gave up 3 minutes or so later and issued an error
message in both windows.

Potentially, with multiple such frames being launched one could make it
crash.

That's beside the point though as the URL spoofing is clearly there.

 

--Mike


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/