2

If I can write a client script (a piece of JavaScript code) that can freeze the entire browser, a force quit/kill being mandatory, is that considered a security issue? If so, what's the type of this bug (a more generic name)?

I remember few months ago someone reported a bug in Chromium that was crashing the current tab when hovering a specific link, and that was labelled with the security tag.

Is it possible to get some profit from bounty programs by reporting such a thing?

Improve this question
1
  • This depends on the rules of the relevant bug bounty program so this question can not be answered in general.
    – Steffen Ullrich
    May 6, 2016 at 16:26

3 Answers 3

Reset to default
7

Freezing a browser is a "Denial of Service" attack to an extent. You are "denying" someone usage of a service, in this case an application. A vulnerability that leads to a Denial of Service. I have done this in the past as a proof of concept against "IE" with a divide by zero javascript.

Most vendors that offer bug bounties offer them based on the ability to exploit a vulnerability in such a manner that could lead to "code execution", "data loss" or something along those lines. Most vendors will tell you "what" they are looking for with their bug bounty programs in their FAQs. Crashing a browser is more of a DoS, developer issue versus an exploitable (oh you can trigger code execution!) one.

So that answers your question but just in case, here is Mozilla's FAQ:

  • Security bug must be original and previously unreported.
  • Security bug must be a remote exploit, compromise user data, allow access to Mozilla infrastructure or resources, or easily manipulate a user.
  • Submitter must not be the author of the buggy code nor otherwise involved in its contribution to the Mozilla project (such as by providing check-in reviews).
  • Employees of the Mozilla Foundation and its subsidiaries are ineligible.
Improve this answer
3
  • It's probably important to highlight the "or" in that first bullet; a remote exploit which crashes the browser or completely locks it is probably at least interesting to them. Script hosts in Chrome are meant to be isolated to at least the tab level, so if you can hang the whole browser it's worth reporting. Crashes like null page dereferences are obviously also important security bugs, especially if you can trigger them through generic content (e.g. unicode), though they're often not considered eligible for bounties.
    – Polynomial
    May 6, 2016 at 18:08
  • :( I directly quoted it hence the linking to it. I do not want to change their wording. When I found my divide by zero via javascript, I just reported it to MSRC via way of CERT+MITRE. Not a fan of bug bounties. Issues like these (crashes) are often left unreported when found by "pay for play" bug hunters
    – munkeyoto
    May 6, 2016 at 18:12
  • I didn't mean you should change your answer; I know it was directly quoted (I read the link). My comment was, itself, intended to highlight the "or" part of that clause. I'm a proponent of bug bounties, but I do agree that they're only part of the picture and (as you noted) they tend not to attract reports for non-eligible issues which are still important to patch.
    – Polynomial
    May 6, 2016 at 18:15
1

If you can make profit from such issues depends on the rules of the relevant bug bounty program so this question can not be answered in general.

And if it is considered a security vulnerability depends a lot on how the issue can be used in an attack. Making some browser freeze might just be an annoyance but making a industrial control system freeze is a way more serious issue.

Improve this answer
0

No, it's not a security issue : it's a stability issue for a browser and/or usability issue for a web app.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.