Google releases a latest security patch for its Chrome Browser

Wednesday, December 3, 2008, 5:31
Internet
322 views
View Comments

It has been only a few days since Google Inc. has introduced its new browser – the Chrome Browser and a very typical vulnerability has been discovered by a Vietnamese security company. However Google Inc. has been really active enough to already create and release a patch for its Chrome browser in order to prevent hackers from attacking files from your PC’s. All users of Google Chrome now can offload you worries and hat’s off to the security researchers for their quick action.

As per the report generated by the BKIS (Bach Koa Internetwork Security based at Hanoi Institute of Technology), the main cause of this vulnerability is a boundary error while handling the ‘SaveAs’ function. The bug is actually a buffer overflow caused due to the saving of any malicious web page having a very long title tag or title tag in HTML. Now, for the purpose of exploitation, the attacker might develop a specially designed web page containing malicious codes. He then would perform a trick to convince the user visit his website and save this page. As soon as the page is saved, the malicious code would get executed, thus making a path for the hacker to use your affected system. This vulnerability can get exploited on the systems running Windows XP SP2 and Chrome version 0.2.149.27. Another flaw of Chrome that had also been fixed is known as ‘Carpet Bombing’ flaw. This could cause Windows to download a harmful JAR (Java Archive) and get it executed without prompting any warning to the users. This could have allowed the attackers to forcibly crash the Chrome browser.

In the latest version of Chrome that is Chrome 0.4.154.18, this critical vulnerability has been fixed and several other features have been included in addition. A Bookmark manager has been introduced in this latest version that take’s care of the in-built privacy mode of the browser and restored pop-up blocker. Besides, it is included with a new version of V8 – Google’s JavaScript Interpreter. However there is a persistent problem with websites that uses Gears for the synchronization of offline data, which might get hanged occasionally.