25 Jun 08 Chrome Security Alert – Carriage Return Null Object Memory Exhaustion Remote Dos

Here’s a security alert for Google Chrome, it seems like some kind of memory leak problem with the Enter key:

*Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos.*
*Version Affected:*
Chrome/0.2.149.30
Chrome/0.2.149.29
*Severity:*
High
*Description:*
The Google chrome browser is vulnerable to memory exhaustion based
denial of
service which can be triggered remotely.The vulnerability triggers when
Carriage
Return(\r\n\r\n) is passed as an argument to window.open() function. It
makes the
Google Chrome to generate number of windows at the same time thereby
leading
to memory exhaustion. The behavior can be easily checked by looking at
the task
manager as with no time the memory usage rises high. The problem lies in
the handling
of object and its value returned by the javascript function. Once it is
triggered the pop
ups are started generating. The Google Chrome browser generate object
windows continuously
there by affecting memory of the resultant system. Probably it can be
crashed within no time.
User interaction is required in this.
*Proof of Concept*
http://www.secniche.org/gds
*Links:*
http://secniche.org/gcrds.html
http://evilfingers.com/advisory/Google_Chrome_Carriage_Return_Null_Objec
t_Memory_Exhaustion_Remote_Dos.php
*Detection:*
SecNiche confirmed this vulnerability affects Google Chrome on Microsoft
Windows XP SP2 platform.The versions tested are:
Chrome/0.2.149.30
Chrome/0.2.149.291
*Disclosure Timeline:*
Disclosed: 22 September 2008
Release Date. September 24 ,2008
*Vendor Response:*
Google acknowledges this vulnerability and “fix” will be released soon.
*Credit:*
Aditya K Sood
*Disclaimer*
The information in the advisory is believed to be accurate at the time
of publishing based on
currently available information. Use of the information constitutes
acceptance for use in an
AS IS condition. There is no representation or warranties, either
express or implied by or with
respect to anything in this document, and shall not be liable for a ny
implied warranties of
merchantability or fitness for a particular purpose or for any indirect
special or consequential
damages.

via securityfocus Tags:carriage return, Chrome Security Flaws/Bugs, denial of service, dos version, google, javascript function, memory exhaustion, memory leak problem, memory usage, null object, object memory, pop ups, proof of concept, resultant system, security alert, sood, task manager, time user, vulnerability

Filed in Chrome Security Flaws/Bugs with 0 Comments

05 Jun 08 Chrome Keyboard Shortcuts for Chrome Developers

Here’s a couple keyboard shortcuts for helping you to work faster on the Chrome browser:
(I personally find that these shortcuts are great for Chrome developers)

JavaScript debugger: Alt+`, or select “Page (icon)|Developer|Debug JavaScript”
JavaScript console: “Page (icon)|Developer|JavaScript console”, or use the Show Console icon at the bottom left of the Element inspector
Element inspector: Right-click on the page, and select “Inspect Element”. You’ll have to navigate the tree control in the left-hand pane, but you should eventually be able to find the part of the page you’re seeking by watching what gets colored on the page as you hover in the DOM tree.
Memory tracker: Shift-Esc or “Page (icon)|Developer|Task manager” gets you the dynamic memory, CPU, and Network usage of all currently running Chrome components. Clicking on Stats for Nerds at the bottom left of the Task Manager or browsing to about:memory gets you a snapshot of the memory details of all running Chrome, IE, Firefox, Opera, and Safari instances.
Create a shortcut: Ctrl-D (like Firefox) or click on the star icon to the left of the address bar
Rearrange tabs: just drag them where you want them to go
Add a Home button: “Wrench (icon)|Options|Basics|Home page|Show Home button on the toolbar”

via infoworld Tags:developers, dom tree, dynamic memory, element, firefox, Google Chrome Hacks, hand pane, home button, instances, keyboard shortcuts, left hand, nerds, opera, page icon, safari, snapshot, star icon, tabs, task manager

Filed in Google Chrome Hacks with 1 Comment

03 Jun 08 Google Chrome has its own "Task Manager"!

The biggest difference between Google Chrome and Firefox/IE is the fact that Chrome has its own Task Manager.

To access the Task Manager in Google Chrome, goto Developer->Task Manager menu as shown below:

As you will see, the Task Manager is very accurate with stats of memory, CPU, and network of each tab, plugin, and the Browser itself. (Now these are actually all different processes in the actual Windows system’s Task Manager too, you can look here for some more info on that.)

Of course, the point of having a Task Manager is that every Tab is managed more efficiently plus you have one window for ending any processes that are causing frozen-windows or simply taking too long to load.

If you click on “Stats for nerds” under the Task Manager, you will also get to see even more detailed stats on the processes running. This sorta reminds me of a Linux system where every detail is accessible by the user unlike Windows.

Our verdict is that the Task Manager on Google Chrome is even better than Windows operating system Task Manager as you get what you see.

This Task Manager might be a great way for developers to add more functions, especially since the Google Chrome is completely open-source. (Yes, you can build your own browser on top of it if you want) Tags:Chrome Features, developers, google, linux, linux system, manager menu, memory, nerds, open source, sorta, task manager, windows operating system, windows system