Google tackles severe Chrome security flaw
Published: 24 Apr 2009 08:47 BST
Google released a new version of its Chrome browser Thursday to fix a high-severity security problem.
The problem affects Google's mainstream stable version of Chrome and is fixed in the new version 1.0.154.59. Google has built Chrome so it updates itself automatically with no user intervention, though the software must be restarted for the new version to run.
The security problem, reported on 8 April by Roi Saltzman of the IBM Rational Application Security Research Group, allowed cross-site scripting attacks. Such methods can make a web browser process unauthorised code such as JavaScript, enabling a variety of attacks, including impersonation or phishing.
Mark Larson, Google Chrome program manager, described the problem in a blog posting on Thursday: "An error in handling URLs with a chromehtml: protocol could allow an attacker to run scripts of his choosing on any page or enumerate files on the local disk under certain conditions."
Larson explained: "If a user has Google Chrome installed, visiting an attacker-controlled web page in Internet Explorer could have caused Google Chrome to launch, open multiple tabs, and load scripts that run after navigating to a URL of the attacker's choice. Such an attack only works if Chrome is not already running."
Credit: Google fixes severe Chrome security hole from CNET News
- Roundup: Full coverage of Google Chrome
- Blog: Google Chrome has Microsoft's code inside, says MS manager
- Blog: Google Chrome — nine things we've found since launch
- Photos: Highlights of the beta browser
- Leader: Chrome needs more than just sparkle
- Video: Can Chrome shine amid the competition?
- Benchmarks: Google Chrome
- Review: Google Chrome (beta)
- Comment: All roads lead to Chrome
- Video: Google Chrome to open new front in browser war
Did you find this article useful?
1 out of 1 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
