Google Chrome Exploits

By PricklyPoo
in Web Browser Discussion & Support

 Share

Recommended Posts

Grand Master

PricklyPoo

Posted
Posted

http://digg.com/security/Google_Chrome_exploit_revealed

Well, this is new news, but if you search on google, you can find more about it.

The main thing is executables can be run without asking the users' permission. While searching google for this (in opera) I even clicked on one result and it said "Would you like to install server.exe?)....So don't be searching this in google chrome hehe.

Link to comment
https://www.neowin.net/forum/topic/665186-google-chrome-exploits/
Share on other sites
Mentor

wellofsouls

Posted
Posted
http://digg.com/security/Google_Chrome_exploit_revealed

Well, this is new news, but if you search on google, you can find more about it.

The main thing is executables can be run without asking the users' permission. While searching google for this (in opera) I even clicked on one result and it said "Would you like to install server.exe?)....So don't be searching this in google chrome hehe.

well, I think it's trying to paint something that's not what it actually is. It's just a combination of the old Safari carpet bombing exploit + an exploit in JAVA. Safari fixed the carpet bombing exploit by providing an option to "ask every time before download" in 3.1.2, while Chrome already has this option right from the start. So technically Chrome has already fixed the carpet bombing exploit, just like Safari 3.1.2, it's IMHO a bit sensationalism to bring the carpet bombing exploit back here. If you can set the browser to show a prompt before downloading something, then it's already not vulnerability to the carpet bombing exploit.

When I go to that PoC exploit demo, I got a prompt of "wanting to download blah blah?" which I pressed cancel. The same thing happens for all other browsers.

Grand Master

shockz

Posted
Posted
People are just blowing it out of proportion. It will be fixed in no time.

This is a major problem... luckly not many people know about chrome yet... and the ones that do are computer savvy enough to avoid malicous sites. But this should be patched right away... and the download pulled until it is. I could right now make a site with an iframe with a malicous download link... pass it around to people... and boom.

I've noticed a distrubing trend... and it started with firefox betas... and how blindly people ignore such serious holes... throwing the "its just a beta" excuse around. Well duh... but you'd think before releasing a beta (and all google stuff is beta) to the mass public something like this wouldn't have happened.

This is a well documented hole and has already been patched with the latest webkit versions... Google should have updated to this or held off until they could get this version in before releasing it.

Grand Master

supernova_00

Posted
Posted
This is a major problem... luckly not many people know about chrome yet... and the ones that do are computer savvy enough to avoid malicous sites. But this should be patched right away... and the download pulled until it is. I could right now make a site with an iframe with a malicous download link... pass it around to people... and boom.

I've noticed a distrubing trend... and it started with firefox betas... and how blindly people ignore such serious holes... throwing the "its just a beta" excuse around. Well duh... but you'd think before releasing a beta (and all google stuff is beta) to the mass public something like this wouldn't have happened.

This is a well documented hole and has already been patched with the latest webkit versions... Google should have updated to this or held off until they could get this version in before releasing it.

True they should have held off but I don't see that many webmasters adding iframes with malicious content. Maybe porn/warez sites but not regular sites. People visiting those types of sites should use anti-virus/malware/spyware software anyway.

The problem definitely needs fixed ASAP though.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Windows 11's big performance boost is finally available for all

      By AndrewSteel · Posted

      So what is it, "Some exciting upgrades happened under the hood, and one of those upgrades is now available to all Windows 11 users." or "Also, you may need to enable it manually, as new features are rolling out gradually. Here is how to do it:" We keep hearing these are rolling out but they never seem to show up, we have force them on with ViVetool. Getting a bit tired of it.
    • Windows 11's big performance boost is finally available for all

      By JoeyC203 · Posted

      Seems very lazy, so basically drain more battery power on laptops/tablets if this is turned on.
    • Edifier's popular R1280Ts bookshelf speaker can be a nice upgrade for your PC desktop audio

      By hellowalkman · Posted

      Edifier's popular R1280Ts bookshelf speaker can be a nice upgrade for your PC desktop audio by Sayan Sen Yesterday we covered a very nice discount on Sony's high-resolution SS-CS5M2 speakers, which are currently on sale for just $178. It packs the rather rare super tweeter that offers an additional level of clarity and "airy"-ness which a tweeter cannot provide. It's a passive speaker though which means it will require external amplification, which will cost extra. Let's say though that you have a budget of under $150 but still want a decent-sounding speaker that's active. The Edifier 1280Ts can help in this regard, as the unit is currently at a decent price of $130 (purchase link under the specs table down below). While you will not get deep sub-bass from the 1280Ts, you should get clearer vocals and highs like cymbals than a cheaper satellite-based 2.1 system. Obviously the soundstage and imaging will also improve due to the better reproduction of highs. As mentioned above, the Edifier R1280Ts is active and so does not need a separate amplifier, as it's a powered system with its own amplification. A great thing about this model is that you can add a separate active subwoofer to it too using the "sub out" option, which essentially acts like an LFE. This way, you can add in the missing deep bass. The technical specifications of the Edifier R1280Ts are given in the table below: Specification Value Total Output Power 42W RMS (21W + 21W) Driver Units 4-inch mid-range/bass driver + 0.5-inch silk diaphragm treble driver Frequency Response 52Hz – 20kHz Signal-to-Noise Ratio (SNR) ≥85dBA Input Sensitivity Line In1: R/L: 500±50mV Line In2: R/L: 700±50mV Inputs Dual RCA inputs Outputs Sub Out port for external subwoofer Get it at the link below: Edifier R1280Ts Powered Bookshelf Speakers - 2.0 Stereo Active Near Field Monitors with Subwoofer Line Out: $129.99 (Sold by Edifier Online Store, Shipped by Amazon US) This Amazon deal is US-specific and not available in other regions unless specified. This is a first-party seller link (at the time of article publishing); ensure that you also purchase from a first-party seller link only. If you don't like it or want to look at more options, check out the previous deals that we have covered, OR you can also visit Amazon US deals page. Get Prime (SNAP), Prime Video, Audible Plus or Kindle / Music Unlimited. Free for 30 days. As an Amazon Associate, we earn from qualifying purchases.
    • Windows 11's big performance boost is finally available for all

      By pookie62 · Posted

      Appreciate the focus on UI performance, but this is going the wrong way. Instead of optimizing performance, coding to lower latency, etc. this is just throwing horsepower. This is lazy.
    • Politically funny images of the World

      By +primortal · Posted

  • Recent Achievements

    • Week One Done
      FBSPL earned a badge
      Week One Done
    • One Year In
      Jim Dugan earned a badge
      One Year In
    • One Month Later
      Tommi118 earned a badge
      One Month Later
    • One Month Later
      sjbousquet earned a badge
      One Month Later
    • Week One Done
      sjbousquet earned a badge
      Week One Done

  • Popular Contributors

    1. 1
      +primortal
      489
    2. 2
      PsYcHoKiLLa
      197
    3. 3
      +Edouard
      155
    4. 4
      Steven P.
      84
    5. 5
      ATLien_0
      69
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!