Google Chrome Exploits

By PricklyPoo
in Web Browser Discussion & Support

 Share

Recommended Posts

Grand Master

PricklyPoo

Posted
Posted

http://digg.com/security/Google_Chrome_exploit_revealed

Well, this is new news, but if you search on google, you can find more about it.

The main thing is executables can be run without asking the users' permission. While searching google for this (in opera) I even clicked on one result and it said "Would you like to install server.exe?)....So don't be searching this in google chrome hehe.

Link to comment
https://www.neowin.net/forum/topic/665186-google-chrome-exploits/
Share on other sites
Mentor

wellofsouls

Posted
Posted
http://digg.com/security/Google_Chrome_exploit_revealed

Well, this is new news, but if you search on google, you can find more about it.

The main thing is executables can be run without asking the users' permission. While searching google for this (in opera) I even clicked on one result and it said "Would you like to install server.exe?)....So don't be searching this in google chrome hehe.

well, I think it's trying to paint something that's not what it actually is. It's just a combination of the old Safari carpet bombing exploit + an exploit in JAVA. Safari fixed the carpet bombing exploit by providing an option to "ask every time before download" in 3.1.2, while Chrome already has this option right from the start. So technically Chrome has already fixed the carpet bombing exploit, just like Safari 3.1.2, it's IMHO a bit sensationalism to bring the carpet bombing exploit back here. If you can set the browser to show a prompt before downloading something, then it's already not vulnerability to the carpet bombing exploit.

When I go to that PoC exploit demo, I got a prompt of "wanting to download blah blah?" which I pressed cancel. The same thing happens for all other browsers.

Grand Master

shockz

Posted
Posted
People are just blowing it out of proportion. It will be fixed in no time.

This is a major problem... luckly not many people know about chrome yet... and the ones that do are computer savvy enough to avoid malicous sites. But this should be patched right away... and the download pulled until it is. I could right now make a site with an iframe with a malicous download link... pass it around to people... and boom.

I've noticed a distrubing trend... and it started with firefox betas... and how blindly people ignore such serious holes... throwing the "its just a beta" excuse around. Well duh... but you'd think before releasing a beta (and all google stuff is beta) to the mass public something like this wouldn't have happened.

This is a well documented hole and has already been patched with the latest webkit versions... Google should have updated to this or held off until they could get this version in before releasing it.

Grand Master

supernova_00

Posted
Posted
This is a major problem... luckly not many people know about chrome yet... and the ones that do are computer savvy enough to avoid malicous sites. But this should be patched right away... and the download pulled until it is. I could right now make a site with an iframe with a malicous download link... pass it around to people... and boom.

I've noticed a distrubing trend... and it started with firefox betas... and how blindly people ignore such serious holes... throwing the "its just a beta" excuse around. Well duh... but you'd think before releasing a beta (and all google stuff is beta) to the mass public something like this wouldn't have happened.

This is a well documented hole and has already been patched with the latest webkit versions... Google should have updated to this or held off until they could get this version in before releasing it.

True they should have held off but I don't see that many webmasters adding iframes with malicious content. Maybe porn/warez sites but not regular sites. People visiting those types of sites should use anti-virus/malware/spyware software anyway.

The problem definitely needs fixed ASAP though.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Windows 11's big performance boost is finally available for all

      By cyberhash · Posted

      Any so called performance increase will be in milliseconds, which nobody will actually notice in real world usage.
    • Windows 11's big performance boost is finally available for all

      By WaltC · Posted

      All it does is use the CPU more efficiently during boot to speed up boot times. That's it. Yawn....
    • Windows 11's big performance boost is finally available for all

      By sphbecker · Posted

      It's not a one or the other kind of thing. Software should run efficiently, and the operating system should appropriately manage the CPU clocks. You could have the best most optimized software on earth, and it will still run faster if the CPU does a better job of boosting as needed. All this is doing is pre-boosting the CPU based on user actions, instead of waiting for the normal detection mechanism to kick in. If the OS knows it is about to need more CPU, why shouldn't it use that knowledge? It's the same idea of downshifting before passing someone, instead of just burying your foot into the peddle and waiting for the transmission to figure out what you want to do.
    • Audacity 3.7.8

      By Copernic · Posted

      Audacity 3.7.8 by Razvan Serea Audacity is a free, open source digital audio editor and recording application. Edit your sounds using cut, copy, and paste features (with unlimited undo functionality), mix tracks, or apply effects to your recordings. The program also has a built-in amplitude-envelope editor, a customizable spectrogram mode, and a frequency-analysis window for audio-analysis applications. Built-in effects include bass boost, wah wah, and noise removal, and the program also supports VST plug-in effects. You can use Audacity to: Record live audio. Record computer playback on any Windows Vista or later machine. Convert tapes and records into digital recordings or CDs. Edit WAV, AIFF, FLAC, MP2, MP3 or Ogg Vorbis sound files. AC3, M4A/M4R (AAC), WMA and other formats supported using optional libraries. Cut, copy, splice or mix sounds together. Numerous effects including change the speed or pitch of a recording. Write your own plug-in effects with Nyquist. And more! See the complete list of features. Audacity 3.7.8 changelog: #10688 Fixed an exception thrown when pasting into a newly-created track (Thanks, David Bailes (@DavidBailes)!) #10870, #10884, #10775, #10629 Fixed tone generation, waveform-scale setting, SetClip Name parameter, and clip-boundary command names for scripting and macros (Thank you, David Bailes (@DavidBailes)!) #11106 Fixed the loading of presets for the Distortion effect (A million thanks, David Bailes (@DavidBailes)!) #10947 Fixed paste into an empty audio track not preserving the source sample rate (Thanks, Juan Gabriel Colonna (@juancolonna)!) #10776 Allowed AltGr modifier in label and clip name editing (Thanks, Davide Peressoni (@DPDmancul)!) #9938 Added options to choose where silence is truncated (start/middle/end) (Thanks, Noah Rosenfield (@nosenfield)!) #9935 Added Podcast 2.0 chapters JSON export for label tracks (Thanks, Noah Rosenfield (@nosenfield)!) #10103 Improve UI on HiDPI displays on Linux/wxGTK (Thanks, Ivan A. Melnikov (@iv-m)!) #10099 Fixed MixerBoard Mute and Solo button display (Thanks, Ivan A. Melnikov (@iv-m)!) #10681 Fixed multichannel FLAC import #10999 Fixed envelope being broken after joining clips Download: Audacity 64-bit | Standalone ~20.0 MB (Open Source) Download: Audacity 32-bit | Standalone Download: Audacity ARM64 | Standalone View: Audacity Home Page | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Windows 11's big performance boost is finally available for all

      By George P · Posted

      There really isn't anything magical about the low latency profile, other OS's do this as well. All they're doing is using your CPUs boost clock options in a more smarter way.

  • Recent Achievements

    • One Month Later
      highriskpaym earned a badge
      One Month Later
    • Week One Done
      highriskpaym earned a badge
      Week One Done
    • One Year In
      highriskpaym earned a badge
      One Year In
    • Week One Done
      FBSPL earned a badge
      Week One Done
    • One Year In
      Jim Dugan earned a badge
      One Year In

  • Popular Contributors

    1. 1
      +primortal
      497
    2. 2
      PsYcHoKiLLa
      198
    3. 3
      +Edouard
      155
    4. 4
      Steven P.
      84
    5. 5
      ATLien_0
      71
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!