Printable Version of Topic

November 6th, 2009
High-risk flaw dings Google Chrome

Posted by Ryan Naraine @ 9:18 am


Google has pushed out a Chrome browser update to fix a pair of security vulnerabilities that expose uses to malicious hacker attacks.

One of the flaws carry a “high-risk” rating because of the threat of arbitrary code execution.

[ SEE: Study: http://blogs.zdnet.com/security/?p=3316 ]

Vulnerability #1: The user was not warned about certain possibly dangerous file types such as SVG, MHT and XML files. In some browsers, JavaScript can execute within these types of files. Because the JavaScript runs in the local context, it may be able to access local resources. Details are being withheld until the fix is pushed out to a majority of users.

Vulnerability #2: A malicious site could use the Gears SQL API to put SQL metadata into a bad state, which could cause a subsequent memory corruption. This may lead to a Gears plugin crash or possibly arbitrary code execution. Google says this issue will be made public once a majority of users are up to date with the fix.

The patch is being silently distributed to all Google Chrome users.

Detailed:
http://blogs.zdnet.com/security/?p=4861