Security world makes short work of Chrome

By

Less than two days into its public life, Google's Chrome browser is being put under the microscope by security researchers.


Two flaws for the web browser have already been discovered and publicly disclosed by researchers. Ramifications of an attack could range from an application crash to remote malware installation.

The first vulnerability was found on Wednesday by researcher Aviv Raff, who discovered that the browser was open to a highly-publicized 'carpet bombing' attack first found in Safari.

Apple patched the flaw in Safari earlier this year. However, because Chrome uses Apple's WebKit software, the flaw has reappeared in the Google browser.

Raff posted a proof of concept page which demonstrates how an attacker could embed malicious code on a web page and then use it to conduct a remote malware installation with a separate specially-crafted Java applet.

Shortly after Raff's discovery was posted, another researcher came forward with a separate flaw in the browser.

Researchers Rishi Narang and JanDeMooij posted separate reports of a vulnerability in the browser's chromium.dll component that was exposed through the browser's URL bar. The flaw could be targeted to cause an application crash, though neither report mentioned the possibility of remote code execution.

Chrome is not the first browser to be picked apart by the security community so soon. Researchers made similarly short work out of Mozilla's Firefox 3 when that browser was released earlier this summer.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Log In

  |  Forgot your password?