Google Chrome update patches XSS vulnerability

April 24, 2009 – 4:36 AM

Mark Larson, the Google Chrome Project Manager, has posted an advisory on the Google Chrome Releases blog advising of a high risk vulnerability in the Chrome web browser. The cross-site scripting (XSS) vulnerability is caused by an error in handling URLs in the ChromeHTML URI handler, allowing an attacker to remotely execute code, violating the same origin policy.

For an attack to be successful, a victim must first be convinced by an attacker to visit a specially crafted malicious HTML page with Internet Explorer, causing Chrome to launch, open multiple tabs and run scripts. The attack, however, only works if the Chrome browser is not already running.

Source:
http://www.h-online.com/security/Google-Chrome-update-patches-XSS-vulnerability–/news/113144