malicious webpage can hang chrome
Reported by
mark.ros...@gmail.com,
Feb 3 2017
|
||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36 Steps to reproduce the problem: 1. Visit pd98342sdo2-env.us-east-1.elasticbeanstalk.com/error.html 2. It will give you the fake security alert shit 3. Try and close tab 4. Close the navigate away popup that chrome gives 5. Observe as the tab is now locked up. 6. Observe Windows Task Manager showing the chrome process rapidly growing in memory usage (4GB+) and CPU is maxed out on a core What is the expected behavior? Chrome closes like normal What went wrong? Chrome locked up preventing closure. I've never thought it was even possible with JS to max out a CPU core. Crashed report ID: How much crashed? Just one tab Is it a problem with a plugin? N/A Did this work before? N/A Chrome version: 56.0.2924.87 Channel: stable OS Version: 10.0 Flash Version: Shockwave Flash 24.0 r0 The malicious behavior here is meant to trick users by forcing them have Windows kill the process for not responding. Then next time they open chrome, they'll restore windows, the page opens up and less knowledgeable users will fall for the fake call tech support message
,
Feb 3 2017
To add, Firefox stops execution of the bad JS after a few seconds. Chrome keeps chugging to death.
,
Feb 6 2017
,
Feb 7 2017
Able to reproduce this issue on Win-10, Ubuntu 14.04 and Mac 10.12.2 using chrome reported version #56.0.2924.87 and latest canary #58.0.3004.3 by following comment #1. This is a non-regression issue as it is observed from M30 old builds. Hence, marking it as untriaged to get more inputs from dev team. Thanks...!!
,
Feb 10 2017
|
||||
►
Sign in to add a comment |
||||
Comment 1 by mark.ros...@gmail.com
, Feb 3 2017Wooo, The following snippet which you can execute in the developer console will cause Chrome to hang var total = ""; for( var i = 0; i < 100000; i++ ) { total = total + i.toString(); history.pushState(0,0, total ); }