Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit

To: rotem@xxxxxxxxxx
Subject: Re: Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit
From: "Razi Shaban" <razishaban@xxxxxxxxx>
Date: Tue, 9 Sep 2008 02:51:22 +0400
Cc: bugtraq@xxxxxxxxxxxxxxxxx
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=/p59fOY+JoYuqNN5vT4ZauMEgDJJQEfjJhANOS8fDWI=; b=K5me8yUqJpAax+dTGUWvuKXiJFpnkznO9q1xblruy9dBe44P7BIjGXquj7h8mkNmCC f6oLQNO3DjZ/coQHkSkrxyltB1aG0QAFREbr1ZvUdz9ZkKP33TnJgdLtEgARyjFgXe2K GsW9F8l8o+XegwAcNUqzfB5wgXt7ceVeJlNZc=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=uU776pxMw8gZ+qxDOY9aYdIdeSvOXHjmjKb8sdKO8LK+MBrQ12ZLQbqpul8EhZTMfi 0cjN2FYkgG378c6Gyb1gqg6NTb+XO2nAbxzx1oN3stWKslJFG7TrTYpkHhkPAjSRsXro IQtKGA+l1jffXZMR0+KtxijKqZ6n9zf02mY0A=
In-reply-to: <48C5397F.6040507@xxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <48C5397F.6040507@xxxxxxxxxx>

This successfully crashed my Chrome 0.2.149.29 Build 1798 running on
XP SP2 upon loading the page.

--
Razi

References:
- Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit
  - From: Rotem Kerner