Google Chrome Exploits

By PricklyPoo
in Web Browser Discussion & Support

 Share

Recommended Posts

Grand Master

PricklyPoo

Posted
Posted

http://digg.com/security/Google_Chrome_exploit_revealed

Well, this is new news, but if you search on google, you can find more about it.

The main thing is executables can be run without asking the users' permission. While searching google for this (in opera) I even clicked on one result and it said "Would you like to install server.exe?)....So don't be searching this in google chrome hehe.

Link to comment
https://www.neowin.net/forum/topic/665186-google-chrome-exploits/
Share on other sites
Mentor

wellofsouls

Posted
Posted
http://digg.com/security/Google_Chrome_exploit_revealed

Well, this is new news, but if you search on google, you can find more about it.

The main thing is executables can be run without asking the users' permission. While searching google for this (in opera) I even clicked on one result and it said "Would you like to install server.exe?)....So don't be searching this in google chrome hehe.

well, I think it's trying to paint something that's not what it actually is. It's just a combination of the old Safari carpet bombing exploit + an exploit in JAVA. Safari fixed the carpet bombing exploit by providing an option to "ask every time before download" in 3.1.2, while Chrome already has this option right from the start. So technically Chrome has already fixed the carpet bombing exploit, just like Safari 3.1.2, it's IMHO a bit sensationalism to bring the carpet bombing exploit back here. If you can set the browser to show a prompt before downloading something, then it's already not vulnerability to the carpet bombing exploit.

When I go to that PoC exploit demo, I got a prompt of "wanting to download blah blah?" which I pressed cancel. The same thing happens for all other browsers.

Grand Master

shockz

Posted
Posted
People are just blowing it out of proportion. It will be fixed in no time.

This is a major problem... luckly not many people know about chrome yet... and the ones that do are computer savvy enough to avoid malicous sites. But this should be patched right away... and the download pulled until it is. I could right now make a site with an iframe with a malicous download link... pass it around to people... and boom.

I've noticed a distrubing trend... and it started with firefox betas... and how blindly people ignore such serious holes... throwing the "its just a beta" excuse around. Well duh... but you'd think before releasing a beta (and all google stuff is beta) to the mass public something like this wouldn't have happened.

This is a well documented hole and has already been patched with the latest webkit versions... Google should have updated to this or held off until they could get this version in before releasing it.

Grand Master

supernova_00

Posted
Posted
This is a major problem... luckly not many people know about chrome yet... and the ones that do are computer savvy enough to avoid malicous sites. But this should be patched right away... and the download pulled until it is. I could right now make a site with an iframe with a malicous download link... pass it around to people... and boom.

I've noticed a distrubing trend... and it started with firefox betas... and how blindly people ignore such serious holes... throwing the "its just a beta" excuse around. Well duh... but you'd think before releasing a beta (and all google stuff is beta) to the mass public something like this wouldn't have happened.

This is a well documented hole and has already been patched with the latest webkit versions... Google should have updated to this or held off until they could get this version in before releasing it.

True they should have held off but I don't see that many webmasters adding iframes with malicious content. Maybe porn/warez sites but not regular sites. People visiting those types of sites should use anti-virus/malware/spyware software anyway.

The problem definitely needs fixed ASAP though.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Microsoft releases new Windows 11 Media Creation Tool with the latest updates

      By ad47uk · Posted

      A shame it don't allow people to bypass the MS account, I will stick to using Rufus.
    • Microsoft about to radically change how often your Edge browser updates

      By zikalify · Posted

      Microsoft about to radically change how often your Edge browser updates by Paul Hill Microsoft has just announced that starting with Edge 152, it will be moving to a two-week release cycle for faster, smaller updates. This faster release cadence will begin on August 27. This change comes just several months after Microsoft switched Visual Studio Code to weekly updates. The company said that the Extended Stable releases will remain on an eight-week cycle and that no admin changes are needed to experience the faster release cycle on the Stable channel. The new two-week release cycle will enable the faster delivery of security updates and platform improvements, all while reducing the size and complexity of individual updates. Microsoft claims that organizations will benefit from this change as it offers predictable validation cycles. For organizations that prefer a “more deliberate pace”, the Extended Stable channel remains an option. This change will affect Edge Stable releases on Windows, macOS, Linux, and mobile. The Extended Stable channel will continue to be updated every eight weeks, or every fourth Stable release, for example: versions 152, 156, 160, and 164. The Extended Stable could be a good option for organizations that don’t want the latest updates twice a month and don’t want as much hassle constantly updating browsers. In the case of Visual Studio Code, many of the updates being pushed by Microsoft are AI-related. As we all know, Microsoft Edge has a lot of AI features, so we could see Microsoft pushing more AI, thanks to the faster cycles. On the flip side, quicker releases could mean faster security updates, which is beneficial in a world where AI systems are hunting for software exploits. What do you think? Let us know in the comments. For more updates on Edge, be sure to follow Neowin's coverage. In May alone, we reported on Edge offering in-browser pop-ups to assist users with website compatibility issues, that Edge was losing Copilot Mode, and that Microsoft had fixed a plain-text password bug in Edge. Source: Microsoft 365 Admin Center
    • Euro-Office must default to ODF to be considered "genuinely European", LibreOffice argues

      By ad47uk · Posted

      not yet, because at the moment it is not a threat to MS, if and I mean if it did become a threat to MS Office, then it may be a different thing. MS don't like competition
    • Zen Browser 1.21b

      By Copernic · Posted

      Zen Browser 1.21b by Razvan Serea Zen Browser is a privacy-focused, open-source web browser built on Mozilla Firefox, offering users a secure and customizable browsing experience. It emphasizes privacy by blocking trackers, ads, and ensuring your data isn't collected. With Zen Mods, users can enhance their browser experience with various customization options, including features like split views and vertical tabs. The browser is designed for efficiency, providing fast browsing speeds and a lightweight interface. Zen Browser prioritizes user control over the browsing experience, offering a minimal yet powerful alternative to traditional web browsers while keeping your online activity private. Zen Browser’s DRM limitation Zen Browser currently lacks support for DRM-protected content, meaning streaming services like Netflix and HBO Max are inaccessible. This is due to the absence of a Widevine license, which requires significant costs and is financially unfeasible for the developer. Additionally, applying for this license would require Zen to be part of a larger company, similar to Mozilla or Brave. Therefore, DRM-protected media won't be supported in Zen Browser for the foreseeable future. Zen Browser offers features that improve user experience, privacy, and customization: Privacy-Focused: Blocks trackers and minimizes data collection. Automatic Updates: Keeps the browser updated with security patches. Zen Mods: Customizable themes and layouts. Workspaces: Organize tabs into different workspaces. Compact Mode: Maximizes screen space by minimizing UI elements. Zen Glance: Quick website previews. Split Views: View multiple tabs in the same window. Sidebar: Access bookmarks and tools quickly. Vertical Tabs: Manage tabs vertically. Container Tabs: Separate browsing sessions. Fast Profile Switcher: Switch between profiles easily. Tab Folders: Organize tabs into folders. Customizable UI: Personalize browser interface. Security Features: Inherits Firefox’s robust security. Fast Performance: Lightweight and optimized for speed. Zen Mods Customization: Deep customization with mods. Quick Access: Easy access to favorite websites. Open Source: Built on Mozilla Firefox with community collaboration. Community-Driven: Active development and feedback from users. GitHub Repository: Contribute and review the source code. Zen Browser 1.21b changelog: New Features Updated to Firefox 151.0.4 Added 'Space Routing', a new feature that allows you to route links to a specific Space. To get started, click on the three dots in your Space name and click on 'Space Routing Settings'. Fixes Fixed extension-opened tabs not being created with the correct container (#14100) Fixed a bug with the Boosts editor having the wrong theme colors (#14099) Improved overflowing space icons being inaccessible and improved the feeling when hovering over them (#13747) Other minor bug fixes and improvements Download: Zen Browser | 89.8 MB (Open Source) Download: Zen Browser ARM64 | Other Operating Systems View: Zen Browser Home Page | Screenshots 1 | 2 | Reddit Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • Louis Rossmann suing Samsung over "990 Pro SSD warranty scam"

      By AsherGZ · Posted

      I am currently using a 4tb stick in combination with a 4tb 9100 Pro. It's only been six months since I bought them but the 990 has already dropped 1% health. Fingers crossed it doesn't go any lower.

  • Recent Achievements

    • Week One Done
      davidbazooked earned a badge
      Week One Done
    • One Month Later
      Jamswaz earned a badge
      One Month Later
    • Week One Done
      Jamswaz earned a badge
      Week One Done
    • Rookie
      Marzoid went up a rank
      Rookie
    • Community Regular
      coch went up a rank
      Community Regular

  • Popular Contributors

    1. 1
      +primortal
      514
    2. 2
      PsYcHoKiLLa
      185
    3. 3
      +Edouard
      159
    4. 4
      Steven P.
      83
    5. 5
      ATLien_0
      75
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!