HTML5 flaw allows data dump to PCs, Macs; most major browsers vulnerable

“Gigabytes of junk data could be dumped onto PCs via a loophole in web code, a developer has found,” BBC News reports.

“The loophole exploits a feature of HTML 5 which defines how websites are made and what they can do,” The Beeb reports. “Developer Feross Aboukhadijeh found the bug and set up a demo page that fills visitors hard drives with pictures of cartoon cats.”

The Beeb reports, “In one demo, Mr Aboukhadijeh managed to dump one gigabyte of data every 16 seconds onto a vulnerable Macbook. Most major browsers, Chrome, Internet Explorer, Opera and Safari, were found to be vulnerable to the bug, said Mr Aboukhadijeh… Only Mozilla’s Firefox capped storage at 5MB and was not vulnerable, he found… In a bid to solve the problem, bug reports about the exploit have been filed with major browser makers.”

Read more in the full article here.

[Thanks to MacDailyNews Reader “Margaret G.” and “Peter S.” for the heads up.]

36 Comments

    1. This has NOTHING to do with Flash. CSS3, Javascript combined with the HTML5 api are replacing flash.

      The HTML5 Data Storage API is not being properly implemented by browsers. Essentially, each site is allowed 5MB of local storage. I haven’t checked out the loophole, but I’m willing to guess that there is a way to make the browser think that limit hasn’t been reached or to spoof what site the data is coming from, allowing multiple instances of 5MB files.

  1. How quickly is each browser maker going to patch this?

    I think this is a good test for the major browser makers – a chance to show users who is really trustworthy and on top of things in the HTML5 world.

    My prediction is:
    Apple, Google, & Opera will all have patches 1-2 weeks, and have most users using the new patched browser within 2-4 weeks.
    Microsoft will take 3-6 weeks to release a patch, and get a majority of users on the patched browser in 10 months.

    Mozilla has the lead now – they had the foresight to prevent this vulnerability from stealing more than 5MB of space in Firefox. There’s no urgent need for them to patch it.

  2. Don’t believe the author of this article. OS X doesn’t have problems like this. It is ONLY Windows that gets this stuff. This author wants nothing but hits. OS X is safe from anything like this. It would ask for a user name and password before it would load. Nothing gets by the authentication process. No worries , go on to the next article that has truth to it.

    1. Actually, no password authorization is required.

      All a user has to do is go to the wrong website in the wrong browser, and the hard drive immediately begins to fill up about as fast as the Internet connection will allow. The exploit demonstration page makes this abundantly clear.

      1. The user doesn’t have to click on anything? (such as click on a download button?)

        I’m assuming the user still has to go to the malicious web site.

    1. There are a few free and shareware apps that dump ALL of Safari’s cache for you. I regularly use a custom task I set up in MainMenu Pro that dumps it as well as dumps the DNS cache and frees up unused RAM. With Safari’s current penchant for devouring RAM, it comes in handy all day long.

      (I’m currently testing Safari v6.0.3 beta, which so far appears to have a better handle on memory management. I like that).

Reader Feedback

This site uses Akismet to reduce spam. Learn how your comment data is processed.