Security world makes short work of Chrome

Two flaws for the web browser have already been discovered and publicly disclosed by researchers. Ramifications of an attack could range from an application crash to remote malware installation.

The first vulnerability was found on Wednesday by researcher Aviv Raff, who discovered that the browser was open to a highly-publicized 'carpet bombing' attack first found in Safari.

Apple patched the flaw in Safari earlier this year. However, because Chrome uses Apple's WebKit software, the flaw has reappeared in the Google browser.

Raff posted a proof of concept page which demonstrates how an attacker could embed malicious code on a web page and then use it to conduct a remote malware installation with a separate specially-crafted Java applet.

Shortly after Raff's discovery was posted, another researcher came forward with a separate flaw in the browser.

Researchers Rishi Narang and JanDeMooij posted separate reports of a vulnerability in the browser's chromium.dll component that was exposed through the browser's URL bar. The flaw could be targeted to cause an application crash, though neither report mentioned the possibility of remote code execution.

Chrome is not the first browser to be picked apart by the security community so soon. Researchers made similarly short work out of Mozilla's Firefox 3 when that browser was released earlier this summer.

Copyright ©v3.co.uk

chromemakesofsecurityshortworkworld