Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Chrome Has a Serious Security Flaw

- - - - -

  • Please log in to reply
No replies to this topic



    MSFN Expert

  • Member
  • PipPipPipPipPipPip
  • 1,114 posts
  • Joined 21-May 07
  • OS:XP Pro x86
  • Country: Country Flag


Just noticed this article ... I don't use Chrome or actually know that much about it ... so it might have been already mentioned in another part of the forum.


Chrome Has a Serious Security Flaw


November 19, 2015




Since Google launched the Chrome browser in 2008, it's built a reputation for speed and security not found in other browsers. While the gap has narrowed in both those areas thanks to improvements in Firefox, and Microsoft creating the new Edge browser for Windows 10, Chrome still has the edge in hacking contests.


That's one reason hundreds of millions around the world have it installed on their computers and mobile gadgets. Unfortunately, a newly discovered security flaw might put that reputation in jeopardy.


A Chinese researcher, Guang Gong, discovered the flaw after three months of work, and built a proof-of-concept he demonstrated at the recent PacSec conference. Using a simple game app with a bit of extra code in it, he forced the phone to call out to a special server and load up a webpage in Chrome containing malicious code.


When the Chrome browser visited the webpage, a flaw in the JavaScript system let the page download another app that took over the Android gadget completely. That's scary, but it gets worse.


Usually, attacks that lead to a full takeover of an operating system require multiple flaws, a number of steps and some user input to work. This attack does it in one go, which means as soon as the user installs a modified app, or visits a malicious page, it's over.


The way Gong's attack works, any app could have the code calling out to a special server with a malicious page. Apps do that all the time for ads and other uses, so it wouldn't trigger any alarms in the Google Play store. That means slipping a malicious app through Google's screening just got easier.


It isn't just Chrome, though. Other researchers are now worried that any third-party app that includes Google's version of JavaScript will also be vulnerable.


Of course, the same flaw exists in the desktop version of Chrome, meaning hackers might adapt it to launch attacks against PCs and Macs. Gong says he informed Google of the flaw in August, but so far there hasn't been a fix released.


Fortunately, Gong hasn't released the details on the flaw, so no hackers should have it yet. Considering it took him three months to find, it will probably be a little while before anyone else figures it out.


Still, you don't want to rely completely on that to stay safe. Here are some things you can do.


Switch your mobile browser to Firefox on Android and Apple, or go back to Safari on Apple.

Be careful when clicking on links you get in email or text messages. Only click if you know where it's going and you trust the person who sent it.

Get a security app that warns you about phishing links and malicious app downloads.


Edited by monroe, 20 November 2015 - 05:23 AM.

How to remove advertisement from MSFN

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users