Serious new vulnerability found in Chrome for Android
A new vulnerability has been found (and thankfully, contained) by Qihoo 360 developer Guang Gong who had been working on the exploit for three months before demonstrating it at the PacSec conference in Tokyo.
The exploit worked by targeting the Chrome app’s JavaScript engine and installed a BMX bike game. Without requiring interaction of the user, the vulnerability demonstration exemplified complete control of the device. All the user has to do is visit a site that contains the vulnerability and the JavaScript hack will take care of the rest.
Google had a representative at this conference who was able to see the bug working in action. As reward for Gong’s work, he will be flown all the way to Vancouver for the CanSecWest Applied Security Conference where he will go on a ski trip.
Thankfully this vulnerability can be patched through a Chrome update through the Play Store, unlike Stagefright which required a software patch to the OS.
Most people are careful about the kinds of sites they visit. Particularly sites offering copyrighted material for free can be riddled with malware and virus links.
Reader comments
- AnonD-81610
- 3pw
... he will be flown all the way to Vancouver for the CanSecWest Applied Security Conference where he will go on a ski trip and have a little accident (and die). :P
- Chuck Norris
- 2Au
Well i did not say all of the people that but iproduct for show... i said usually(mostly) people do this. and i mean a lot of them...
- Anonymous
- vx6
what a nice gesture. You alert a big corp about a security risk and instead of denying everything to death and bringing in the lawyers, they reward the guy for finding and fixing their bad. thumbs up.
Tip us
884k
149k NEW!
756k
RSS
Log in I forgot my password Sign up