Hi there;
A few days ago I realized a security issue in Chrome. It is that: as you know,  "Prefetch resources to load pages more quickly" setting comes enabled defaultly. In this case, the javascript code of the site seems on first order of the search result of Google runs automatically.

It can cause CSRF and unwilling download, even DDoS attacks as seen on the videos in attachment.

VULNERABILITY DETAILS
When "Prefetch resources to load pages more quickly" option is enabled, Javacript codes on the site seen on first order of search result run automatically. Google does it to load sites quickly, however some security issues arises from there. For example CSRF through Google, Unwilling File Download, or maybe some DoS attack using most wanted search keywords.

You know CSRF is also known as SEA Surf, in this scenario, we can call this vulnerability as SEO-SURF.

Image the possibilities:
A prepared a malicious site contains some harmful Javascript codes may lead users to trigger some CSRF vulns on other sites or make DoS request to other resources  or may cause some unwilling downloads

I configured the site for a most wanted search keywords.
When this keywords are queried, my site is shown on first order then these malicious codes will run.


VERSION
Chrome Version: 50.0.2661.102 m
Operating System: Windows 8.1 64Bit Single Language Pack

REPRODUCTION CASE
Firstly, I realized it, typing "superlogout" in Google search box. The site named www.superlogout.com was seen on first order of search result, then my all accounts were logged out. I amazed. After this, I tried another possibilities. I added some malicious codes into my friend`s site (www.emre-yilmaz.net and www.denizparlak.com).

When entrying some keywords brings my friends`s sites to first order in search result, malicious codes ran. By this way, a file (src.x - a bash script) downloaded in tmp folder and logout from account (Dropbox, Gmail, Amazon) done.

For fore detailed information please look files in attachment.



 

Deleted: poc.gif 1.6 MB

	poc.gif 1.6 MB View Download

Deleted: download_over_google.gif 1.2 MB

	download_over_google.gif 1.2 MB View Download