Google Chrome Crashes with All Tabs

vendor:

Chrome Browser

by:

Rishi Narang (psy.echo)

7.5

CVSS

HIGH

Undefined-handlers in chrome.dll

119

CWE

Product Name: Chrome Browser

Affected Version From: 0.2.149.27

Affected Version To: 0.2.149.27

Patch Exists: YES

Related CWE: N/A

CPE: a:google:chrome

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP Professional SP3

2008

Google Chrome Crashes with All Tabs

An issue exists in how chrome behaves with undefined-handlers in chrome.dll version 0.2.149.27. A crash can result without user interaction. When a user is made to visit a malicious link, which has an undefined handler followed by a 'special' character, the chrome crashes with a Google Chrome message window 'Whoa! Google Chrome has crashed. Restart now?' It lies in dealing with the POP EBP instruction when pointed out by the EIP register at 0x01002FF4.

Mitigation:

Update to the latest version of Google Chrome Browser

Source

Exploit-DB raw data:

---------------------------------------------------
Software:
Google Chrome Browser 0.2.149.27

Tested:
Windows XP Professional SP3

Result:
Google Chrome Crashes with All Tabs

Problem:
An issue exists in how chrome behaves with undefined-handlers in chrome.dll version 
0.2.149.27. A crash can result without user interaction. When a user is made to visit 
a malicious link, which has an undefined handler followed by a 'special' character, 
the chrome crashes with a Google Chrome message window "Whoa! Google Chrome has crashed. 
Restart now?". It lies in dealing with the POP EBP instruction when pointed out by the 
EIP register at 0x01002FF4.

Proof of Concept:
http://evilfingers.com/advisory/google_chrome_poc.php

Credit:
Rishi Narang (psy.echo)
www.greyhat.in
www.evilfingers.com
---------------------------------------------------

PoC Working/Exploit:
Click for a demo &lt;a href="EVIL:%"&gt;HERE&lt;/a&gt;

# milw0rm.com [2008-09-03]