Does prefetching/preloading in web browsers pose a security risk?

Question

Today I googled the name of a domain that was reportedly serving up malware. My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert saying that it had detected some js malware in my temporary files.

I had only searched for the company on google. No clicks were made. Therefore, I'm assuming this detection is the result of prefetching performed by Google Chrome which must have loaded the malicious file.

My question is: could this malware execute, or would it be sandboxed by some safety mechanism that might exist for the prefetch/preload pages?

Answer 1

Pre-fetching as I understand it in Google Chrome performs things like DNS lookups and static content caching. In order to determine what static content to download, some parsing of the HTML document it pre-fetches must be conducted and it is known that browsers have been vulnerable to malicious HTML payloads in the past (Internet Explorer CSS and HTML parsing bugs leading to shell-code execution).

One must then reasonably conclude that yes, pre-fetching does pose a security risk to users in the sense that it downloads and processes essentially code from pages that you may not have intended it to.

I am presuming that the pre-fetched processing logic still enforces the same-origin policy requests but again depending on how separated the pre-fetching logic is to ordinary page loads there is a possibility a vulnerability exists here which only occurs when a malicious page is pre-fetched rather than visited directly.

Given the somewhat limited benefit of marginally faster page loads, I'd recommend if there's a chance you're frequently visiting pages that reference known malicious pages (e.g. because you're doing security research) it is worth disabling pre-fetching.