Hacker News Reader

Comment by darkhorn | Hacker News Reader

Good news! That crash (RGB24ToARGBRow_SSSE3) is fixed in Firefox 67 Beta, which will be released on May 14:

Tested on 66.0.3 on a fully updated Windows 10 (64bit all around) and it works fine.

Works fine on Firefox 66.0.3 (64-bit) on Linux.

If it crashes it, there may be an attack vector here!

If you really want to crash a Firefox browser without JS, there's this: https://fan-pages.herokuapp.com/

It basically keeps sending iframe's with data URL's for download, see code: https://github.com/wybiral/crash

On Chrome it blocks request popups after the first but FF usually crashes (even Tor Browser).

The interesting thing about this is that you can keep the connection open as long as you want and then send the iframes on command.

>The interesting thing about this is that you can keep the connection open as long as you want and then send the iframes on command.

What do you mean?

If I'm operating the server I can keep the connection open to your browser and wait until sending the iframes to crash you.

So combined with other tracking techniques (to tell if a tab is still open) you can crash their browser and see which other tabs close.

Works great in Firefox 68.0a1 on Fedora 29 with the HTC Vive front-facing camera.