I have been able to make Google Chrome crash, and I was wondering if there are tools or heuristics to determine whether or not the crash is a security vulnerability.

How can I determine if a Chrome crash is also a security vulnerability?

  • I'd be interested in seeing a crashdump. Could you post a stack trace, or the dump file? – Polynomial Aug 1 '12 at 21:31
  • Where can I find the stack trace, or the dump file? – Randomblue Aug 1 '12 at 21:34
  • Not sure on OSX. Try a Google for "OSX chrome crash dump location" or something similar. – Polynomial Aug 2 '12 at 5:45

I suggest reading Best way to triage crashes found via fuzzing, on Linux?, which describes exactly how to do a first-pass triage at assessing the likelihood that the crash is also a security problem. Tools like !exploitable and Valgrind memcheck are your friend.

If it passes the first-level check, the next step is probably to report it to the Chrome folks and let them evaluate it in greater detail.


Perhaps this post may help you, http://blog.chromium.org/2012/04/fuzzing-for-security.html. In particular, check out Address Sanitizer. Anyways, you need to analyze the crash file which is in various locations depending on distro. Have fun.

  • Thanks. Crash file? Could you point me to some documentation or some sort? – Randomblue Aug 1 '12 at 21:07
  • What OS are you using? – Richard Belisle Aug 1 '12 at 21:29
  • I'm using OS X 10.7 – Randomblue Aug 1 '12 at 21:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.