VULNERABILITY DETAILS
I was fuzzing a font library and found two strings that freeze chrome windows. So for example, it caused my secure shell window to hang on chrome os and also locked up a cider window. These strings could be posted to forums and it would lock out everyone using chrome/chromeos.

VERSION
Observed in

Chrome Version: Version 67.0.3396.87 (Official Build) (64-bit)
Operating System: glinux

and

Google Chrome	66.0.3359.203 (Official Build) (64-bit)
Revision	0
Platform	10452.99.0 (Official Build) stable-channel samus


REPRODUCTION CASE
Strings are attached and dumped to hex. To recover use xxd -r, for example,

xxd -r crash-0644b7346a7d1eeb165ea4496678164de865b91c.hex > crash-0644b7346a7d1eeb165ea4496678164de865b91c

To repro the bug open the recovered file in a chrome browser and it will hang the tab.

 

Deleted: crash-0644b7346a7d1eeb165ea4496678164de865b91c.hex 1.8 KB

crash-0644b7346a7d1eeb165ea4496678164de865b91c.hex 1.8 KB Download

Deleted: timeout-04613918eecaab18f832f9006bf8a03e9ae666e3.hex 1.8 KB

timeout-04613918eecaab18f832f9006bf8a03e9ae666e3.hex 1.8 KB Download