New issue
Advanced search Search tips

Issue 658590 link

Starred by 1 user

Issue metadata

Status: Duplicate
Owner: ----
Closed: Oct 2016
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug



Sign in to add a comment

Security: Javascript history.pushState() Memory Corruption / Exhaustion

Reported by fdhi...@gmail.com, Oct 23 2016

Issue description

VULNERABILITY DETAILS
Javascript::history.pushState() memory corruption that results in an extensive amount of system memory being used. Through my tests, over 2.5GB of memory was used, and rising, within 10 seconds of running the vulnerability resulting in a crash or complete, temporary, freezing of the system until process is force killed, if possible, or reboot is required. CPU Usage seems to increase as well, in my case running an octa-core i7 at 2.50ghz , over 50% of CPU was being exhausted.

VERSION
Chrome Version: 54.0.2840.71 m (latest stable)
Operating System: Windows 10, x86 (32bit)

REPRODUCTION CASE
Attached are all necessary Files in a zip archive and i also attached them separately, in case the archive is a security issue. Simply click on "Launch" to start, Code is clear and not obfuscated.
Note: Files need to either be hosted online or on local server (example: Xampp) to work.
Type of crash: browser / System (depending on memory resources)
 
Javascript 0day.zip
2.3 KB Download
0day.html
794 bytes View Download
iframe.js
380 bytes View Download
main.css
847 bytes View Download
pushState().html
413 bytes View Download
resource.html
106 bytes View Download

Comment 1 by fdhi...@gmail.com, Oct 23 2016

hope i put this in the right spot for the chromium bounty program :)
Can you explain why you believe there's "Memory corruption" as opposed to simple exhaustion?

The hang/OOM exit appears to be dupe of Issue 489470 and/or Issue 648333.
Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Mergedinto: 648333
Status: Duplicate (was: Unconfirmed)
Agreed that this doesn't appear to be memory corruption, but rather only a denial of service. Thanks for the report either way, it still helps us.

Sign in to add a comment