-------------------------

VULNERABILITY DETAILS

Clicking select elements without the multiple attribute triggers a native display select widget. In Chrome the nodes inside the select element can be modified even when the native widget is open, resulting in unchecked growth of native widget. The exploit below simply doubles the number of the select's nodes as quickly as possible. 

The result is Chrome becoming unresponsive on my iMac with 16 Gb RAM and Chrome Helper process' memory usage growing to use all memory over the course of a few minutes. Neither the tab nor the browser can be closed.

Tested in latest stable chrome on OSX and Android. On Android, it is possible to close the tab if you act before it runs out of memory. 

VERSION
Chrome Version: [71.0.3578.98] + [stable]
Operating System: [macOS 10.14.2 (18C54), V8 7.1.302.31]

REPRODUCTION CASE
Attach HTML file. 
Simply access this file with Chrome, and click on the select element, to reproduce.

FOR CRASHES, PLEASE INCLUDE THE FOLLOWING ADDITIONAL INFORMATION
Type of crash: [browser]
Crash State: [browser completely unresponsive, Out Of Memory (Chrome Helper)]
Client ID (if relevant): [NA]

CREDIT INFORMATION
Externally reported security bugs may appear in Chrome release notes. If
this bug is included, how would you like to be credited?
Reporter credit: [Cris Stringfellow @ Dosyago Corporation]

 

Deleted: index.html 270 bytes

index.html 270 bytes View Download