Today I googled the name of a domain that was reportedly serving up malware. My search results came up (with the compromised domain at the top of the list) and within seconds my AV gave an alert saying that it had detected some js malware in my temporary files.

I had only searched for the company on google. No clicks were made. Therefore, I'm assuming this detection is the result of prefetching performed by Google Chrome which must have loaded the malicious file.

My question is: could this malware execute, or would it be sandboxed by some safety mechanism that might exist for the prefetch/preload pages?

  • There's the old joke: someone implemented the nuclear launch button as an <a> tag which sends a GET request. A search engine crawled the launch page the other day and started WWIII. I'd definitely say anything along these lines is a security risk :P – billc.cn Jan 28 '16 at 13:47

Pre-fetching as I understand it in Google Chrome performs things like DNS lookups and static content caching. In order to determine what static content to download, some parsing of the HTML document it pre-fetches must be conducted and it is known that browsers have been vulnerable to malicious HTML payloads in the past (Internet Explorer CSS and HTML parsing bugs leading to shell-code execution).

One must then reasonably conclude that yes, pre-fetching does pose a security risk to users in the sense that it downloads and processes essentially code from pages that you may not have intended it to.

I am presuming that the pre-fetched processing logic still enforces the same-origin policy requests but again depending on how separated the pre-fetching logic is to ordinary page loads there is a possibility a vulnerability exists here which only occurs when a malicious page is pre-fetched rather than visited directly.

Given the somewhat limited benefit of marginally faster page loads, I'd recommend if there's a chance you're frequently visiting pages that reference known malicious pages (e.g. because you're doing security research) it is worth disabling pre-fetching.

  • 1
    Prefetched/preloaded resources are only downloaded, they are not supposed to be parsed by the browser. The site will need to prerender if the attacker wants to exploit content parsers. Prefetch/preload may still be vulnerable to HTTP parser exploits though. – Lie Ryan Jan 28 '16 at 13:34
  • 2
    I think I mislead you by mentioning the CSS parsing vulnerability in IE. I believe HTML is still parsed by the prefetch engine, though, in order to obtain what other static content should be downloaded. – deed02392 Jan 28 '16 at 14:00

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .