First cracks in Chrome

chris

Security flaws in Google's new Chrome browser have been publicly disclosed by security researchers.

The first vulnerability was discovered yesterday (September 3rd) by Aviv Raff, who found that the browser was susceptible to the famous carpet bombing attack, which had been used on Apple's Safari.

Chrome uses Apple's WebKit software, and while the company patched Safari to deal with the problem earlier in 2008, it has resurfaced in Google's offering.

Using the flaw, an attacker could use a Java applet to remotely install malware via malicious code on a web page.

The second problem - a vulnerability in the chromium.dll component which was exposed in the URL bar - was discovered by Rishi Narang and Jan de Mooij.

A hacker taking advantage of this could cause an application crash.

And the new browser hasn't just caused security problems for Google - the company had to change the user agreement yesterday because it initially claimed that Google owned the rights to 'any content which you submit, post or display on or through' the browser.


Source:BCS