12 ms·
Opening http://../foo on Android Chrome crashes the browser (Warning: or worse)
- antoineaugusti 5y agoWarning: if you do this on your Android phone at the moment, you may have to completely clean your Chrome application storage to be able to use the app afterwards.
- clon 5y ago> Note: this is even worse if the URL was opened from an intent. In that case, Chrome can end up completely bricked because upon restart it will immediately attempt to re-open the URL that crashed it. I could not recover from this without having to fully "Clear Storage". Too late for me. Not even from intent. Chrome force stop later, it still tries to load it and immediately crashes.
- Helmut10001 5y agoOff Topic: I don't get it why, after 10 years of mobile browser development, there still is no "close all tabs at end" option. Every time I visit my parents, I have to clean up their 150+ open chrome android tabs because they don't understand how to properly clean up their browsing sessions. Why on earth would I want to open the same old tabs in the morning, that I already looked at the day before?
- soco 5y agoBecause they are the tabs with your email, facebook, news, and and and.
- Helmut10001 5y agoIs it really necessary to permanently monitor these distractions? (rhetorical question)
- loloquwowndueo 5y agoThat’s what pinned tabs are for.
- Sharlin 5y agoBecause for a large number of people (including me) tabs are also bookmarks. Granted, most of them I’ll never get back to, but it’s a habit that’s difficult to break.
- croes 5y agoYep, because you can't save all open tabs as bookmarks
- Sharlin 5y agoThat’s not the point, and sarcasm is uncalled for.
- croes 5y agoThat's not sarcasm. Because this feature is missing on chrome android I only have the option to close all tabs or to manually open each tab and decide to bookmark it or not.
- Sharlin 5y agoAh, sorry. I was thinking of desktop browsers that do have the feature (but I don’t think I’ve ever used it as, well, I hardly use bookmarks).
- smichel17 5y agoI disable url bar autocompletion for history, so it's only for bookmarks and open tabs, and use my bookmarks as a way to choose which sites are easy to get to.
- Helmut10001 5y agoI think bookmarks on Desktop disappeared for a reason: They are not really useful. On Android, you can save "bookmarks" as symbol-links or install in case of PWAs. These symbols can be organized pretty good using the main Android interface. No need for a dedicated browser feature. On Desktop, if I want to memorize a blog post etc., I use tools such as ArchiveBox, which also prevents later inaccessibility. To memorize pages on Desktop, there're better features available that integrate more direcly on the OS level, e.g. similar to Android symbols.. There are also self hosted link organizers with tagging feature etc.
- mod50ack 5y agoThere are such options on Firefox. Auto close and close on quit, although annoyingly the latter now requires choosing quit from the app menu instead of just closing the app like a few years ago. There is also "close all tabs" if you just hold the tab button, as well as in the ... menu on the tab screen
- Helmut10001 5y agoYou are right. My point is that you have to take steps to close tabs, if it is just "explicitly closing Firefox". On Desktop, the browser will be terminated on shutdown. Shutdown does not apply to phones. If I want to close all tabs the second I lock my phone - no such thing. It would be enough having a "Stop all Apps&Tabs at 12am" feature. This is really why I avoid browsing things on my phone at all, or use self-hosted progressive web apps that run in dedicated tasks. Btw. - can someone explain why my initial comment is downvoted - Is it because my use case appears ignorant or unusually extravagant?
- david_allison 5y agoCan you clear the app data via adb?
- clon 5y agoCould not be bothered to try (my daily driver on Android is Firefox)
- Namidairo 5y agoClearing cache was sufficient enough for me to launch Chrome and quickly close the tab.
- exciteabletom 5y agoIs "foo" used to mean any string, or is it literally only "../foo" that crashes it?
- guywhocodes 5y agoAny string, does not apply to brave so not a seemingly a webkit issue
- pwdisswordfish8 5y agoIt wouldn't be. Neither Brave nor Chrome use WebKit.
- atatatat 5y agoUnless you're on iOS, in which case Chrome/Brave/all are just a crude wrapped for Safari/WebKit.
- tester34 5y agoMy bet is on url parser in unsafe language
- junon 5y agoYou realize "safe" languages don't protect you from all bugs, right? So tired of this narrative on HN.
- tester34 5y agoFrom some bugs (or serious consequences in fact) they do, don't they?
- junon 5y agoYou can easily shoot yourself in the foot in any language.
- tialaramex 5y agoFor one thing that are plenty of toy languages where you'd be lucky to do anything in particular, including shoot yourself in the foot, "easily". But also there are languages which have much higher bars for safety than you seem to have imagined. Notice how WUFFS doesn't have a "Hello, world." example program because printing out Hello, World is way too dangerous to be allowed in WUFFS even on purpose.
- erik_seaberg 5y agoUnsafe code can make even safe and correct code behave unpredictably, which is a lot more dangerous than merely crashing in an obvious way.
- chrismorgan 5y agoBut actual crashes are most likely due to memory unsafety; I’d be extremely surprised if the root cause was not found to be in a memory-unsafe language, though I doubt it’ll be in the URL parser.
- throwaway3b03 5y agoI just did and the whole phone was frozen. I couldn't force close Chrome, nor do a graceful power off. After 2 min, a notification came up that allowed me to finally close the browser. Amazing how even after an army of contributors and a fairly old project still has bugs as trivial and yet significant as this one. It's a regression, but even so.
- cute_boi 5y agowell most people work for $$ or for promotion so usually bug fixing is less important than landing some new privacy sandbox advertisement things. Also by reviewing code carefully doesn't make you stride the ladder. And if there are bugs they can just tell their manager we fixed this bug etc.And Google organization structure incentivize them. And now google has hegemony on Desktop browser and controls the engine they can get away easily. This is also probably reason why many products are simply killed by google.
- junon 5y agoOn XiaoMi phones at least, this is a system app (see: bloatware). That means you can't clear its app data nor uninstall it, effectively bricking Chrome permanently. The only thing you can do is uninstall the updates, which force resets its persistence, losing all of your stored data/sessions. If you've already done that... tough luck, I guess? What an awful bug.
- thaumasiotes 5y ago> That means you can't clear its app data nor uninstall it, effectively bricking Chrome permanently. I foresee a "brickrolling" trend.
- thevinter 5y agoI have a Redmi Note 7 and it blocked chrome for a minute, but after closing and reopening it the issue resolved itself. Weird, seems very system dependant.
- BelenusMordred 5y ago> On XiaoMi phones at least, this is a system app You mean on Xaiomi OS's (I forget their name).
- uap 5y agoI did this and was so furious the phone was bricked i threw my phone out a train window.... Was i too soon?
- ghuin 5y agoWhat are you typing this on?
- DarthNebo 5y agoDid this to Chrome on Android & it crashed, but only for the first time. Subsequent requests simply took me to google search results instead of resolving the URL.
- chrismorgan 5y agoReminds me how in the first public release of Chrome you could crash the entire browser by typing % in the address bar.
- hulitu 5y agoOn older versions of Chrome just goes to google.com and searches for this string. That's why i disabled automatic updates on my phone. Give me a changelog and i update. Bug fixes and performance improvements it's not a changelog.
- chinathrow 5y agoYeah I am in the same boat - however most apps just have a changelog message similar to "We cleaned the app under the hood. It works now better."
- znpy 5y agoi stopped bothering about that. i used to not like updated, and just postponed them. then noticed that after a while android would just update everything silently (without my consent). so i guess... whatever, it's a lost cause. I hate modern smartphones.
- aufhebung 5y agoStrangely this bug does not seem to occur in incognito mode, at least on my phone.
- kklisura 5y agoWorks as expected on Brave (it's Chromium based)
- Scoundreller 5y agoYou mean bricking/crashing or nothing ?
- NullPrefix 5y agoIt depends on whether you're aware of this issue or not.
- kklisura 5y agoThe bug report contains expected result "DNS resolution error, or some kind of non-fatal error in general." - so that's what I meant by works as expected. It just shows DNS failure page, it does not crash the browser.
- r3muxd 5y agodoesn't work for me on kiwi 94 (a fork of chrome) https://imgur.com/a/pBtuwRW https://imgur.com/a/pBtuwRW maybe you need to be not in incognito? i didn't want to test out of it in case it actually bricks my browser
- meibo 5y agoNot sure what I expected. My poor tabs.
- 0xdeadb00f 5y agoNot an issue in Bromite or GrapheneOS' Vanadium chromium fork. edit: correction: it effects both. Incognito tabs aren't affected.
- ptidhomme 5y agoWell, mine did brick on Vanadium. Didn't try Bromite.
- 0xdeadb00f 5y agoActually it affects both. I was using Incognito to test it out. Turns out it doesn't work in incognito.
- totetsu 5y agoNow to get some QR codes of that url printed on sticker paper...
- SimeVidas 5y ago> Chrome freezes and/or crashes. Note: this is even worse if the URL was opened from an intent. In that case, Chrome can end up completely bricked because upon restart it will immediately attempt to re-open the URL that crashed it. I could not recover from this without having to fully "Clear Storage". You’re telling me Chrome does not have that feature where after a few failed attempts, the browser offers you to not open the websites from the previous session? Firefox has that.
- atatatat 5y agoWindows has historically recovered from repeated unsafe shutdowns better than Linux. Squeaky wheels getting grease, and such.
- pritambaral 5y agoOnly during updates, IME.
- eganist 5y agoSurprised this wasn't submitted or treated by Google as a security defect. I don't think Google pays out for DoS typically, but considering how easily this can be weaponized, this one probably should've paid out. Especially if the mechanism of the crash also allows for an RCE that hasn't been discovered yet. Worth equipping fuzzers with the URL as a prefix. Edit: They reclassified it as a security defect and restricted permissions on it after my comment directly on the bug.
- edgall 5y agoAbsolutely. I'm surprised this isn't marked as critical. If this was included in malicious emails and texts, it would block the use of Chrome on Android completely and the only current fix is to clear all browser data i.e. bookmarks, passwords etc.
- sigmonsays 5y agoWhen I open https://bugs.chromium.org/p/chromium/issues/detail?id=1252624 https://bugs.chromium.org/p/chromium/issues/detail?id=125262... i get permission denied. Why am I getting "Permission denied" trying to view a bug?
- Arnavion 5y agoIt was marked security-sensitive some time within the last 14 hours. It was available to me when the link was submitted here on HN.
- chizhik-pyzhik 5y agocan anyone post a mirror? archive.org doesn't seem to support bugs.chromium.org :/
- junon 5y agoThere wasn't anything there to be honest. Nobody had replied to it and it was still status:unconfirmed. The instructions were pretty bare - just visit the afflicted link. There wasn't any response or activity prior to it being marked as private.
- deleted 5y ago[deleted]
- tssva 5y agoDoesn't crash for me. Takes me to Google search.