2

When there is a vulnerability like Flash's in any piece of software such as Chrome, is it disclosed immediately to the general public, or is it kept a secret until it is patched?

If the former, are all the details of the vulnerability usually disclosed?

2

Usually the vendor is informed by the person who has found the vulnerability. The vendor is given some time to fix the issue before the vulnerability is disclosed publicly. This is called responsible disclosure. This way, there is already a fix available when the vulnerability gets publicly known.

  • and how do some vulnerbilities become active exploited and how do so much hackers get to know about them – badaboo Dec 26 '16 at 13:16
  • @badaboo there are forums that specialize on sharing exploits for profit. – Elzo Dec 27 '16 at 1:51
1

For bugs in Google Chrome there is the Chromium issue tracker. Security bugs are submitted and resolved over this system just like normal bugs. The difference is that they are flagged with special security labels outlined here. For example, the label Restrict-View-SecurityTeam will keep a bug secret between the reporter and the Chromium security team.

is it disclosed immediately to the general public, or is it kept a secret until it is patched?

Bugs submitted through the issue tracker will usually automatically be disclosed some time after the bug is fixed. Waiting until a patch is available is called responsible disclosure and a precondition to participate in the Chrome vulnerability reward program.

If the former, are all the details of the vulnerability usually disclosed?

Since the bug description and the developers' comments and actions are visible through the bug ticket, it will usually be possible to get all information about the issue once it's made public. Since Chrome is an open-source project, changes in the source code are also publicly available and it's often even possible to reverse-engineer fixed security problems from code changes.

It is up to the researcher who found the bug if they want to disclose their bug responsibly through the tracker with the perspective of receiving a reward or sell it somewhere else (e.g. ZDI). They could also just decide to make it public immediately ("full disclosure").

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.