Do not open that page: The string to never put on Chrome

Last updated Jun 23, 2017 443

They serve only 16 characters to crash Google Chrome and all open tabs in it. Here they are, but use them with discretion.

With a string of very few characters Chrome enters the ball. The most popular browser in the world is suffering from a glaring bug reminiscent with the proper proportions similar problems of previous versions of iOS. As little as only a little over 10 characters to crash the browser of Google and all the open tabs. The problem arises by including the string http://a/%%30%30 in the address field, but also by moving the cursor over the URL you send easily crash the application (we left it in purely a text format for obvious reasons ).

The issue was raised by user @thenickde on Twitter during the weekend, and the exploitation of the vulnerability is still possible on the latest version of Chrome today publicly released, the 45.0.2454.93. The browser gets it in all versions available on desktops, on both Windows 10 and OS X El Capitan or Chrome OS. Even Opera, also based on Chromium 45, crashes with the text string that we reported.

The crash seems to occur even with strings http://a/%%300 and file:///%% 300. What makes it special is the bug that triggers a fatal exception (SIGTRAP), and not a typical error caused by similar sources. This means that entering the code involved is a part of the executable that the developers did not think could be reached.

Explain what’s going on the British site TheRegister: ” The text %%300 at the end of the URL is converted to 00% (0x30 is the ASCII code 0. The text %%300 becomes the following string of characters: the % original, 0 converted, and the original 0. Combined become 00%. This places a NULL byte at the end of the web address “. From here it triggers a series of operations, with the browser that tries to process a URL considered invalid and eventually causing the crash of the tab and all software.

Google is aware of the problem and is trying to find a way to solve it: ” It seems that the problem is in a very old part of the code, ” he said on the support page. ” In the debug build, it is made a DCHECK on an invalid URL in the database GURL, within a code in History. ” It does not seem that the vulnerability compromise the security of the browser anyway, even though it is marked as such the great care. All desktop versions of Chrome are involved in the bug, which does not seem to relate to the variants available on the mobile.