Google Chrome beta is officially out, but security researchers have discovered a security vulnerability that is still present in Chrome.
The WebKit engine used inside Chrome leaves it vulnerable to the infamous Safari carpetbombing flaw, security researcher Aviv Raff warns. The flaw stems from a combination of a vulnerability in Apple Safari WebKit and a Java security bug, security blogger Ryan Naraine.
As a result Windows users of the beta software might be tricked into downloading malicious files onto their desktop. Raff has published a harmless proof-of-concept exploit in order to illustrate his concerns.
Apple patched the vulnerability with Safari v3.1.2, but the underlying software behind Chrome is based on older code, hence the vulnerability.
Security watchers warn further vulnerabilities are bound to arise. Against this many are praising the speed and built-in security features of the browser. Chrome features built-in sandboxing for each tab, anti-phishing technology and a privacy (ie smut-surfing) mode. ®
Note :- if u want to see the exploit really working then use Chrome
check this proof-of-concept which demonstrates the automatic download vulnerability that was already fixed by Apple. This PoC will automatically download a JAR file and place it in the the downloads folder. google shows a button in the bottom of the page which looks like part of the webpage , you are directed to click on that by this demo page. It runs the jar file without giving any cautions.
2 Responses
Stay in touch with the conversation, subscribe to the RSS feed for comments on this post.
Continuing the Discussion