`tar` up an entire WordPress install, save it as `favicon.ico` and then easily pull the files from the server.
This would be a good idea to get fixed very soon, I would assume.
EDIT: I stand corrected in terms of exploit-ability, but I still assert that crashing a browser and chewing tons of bandwidth are pretty big issues.
assuming I have access to the server to create the tar and save it, what's the difference between downloading the archive as favicon.ico or any other name?
What would be the point of adding a limitation to the favicon size really? Protecting users from websites where the webmaster is silly enough to put a 1GB favicon by mistake? Doesn't seem common enough to warrant the extra code IMHO.
Uh, yea, the browser shouldn't become unresponsive, break, or behave in such unexpected ways. Not having a limit is just sloppy. Understandable how it'd be overlooked, but sloppy none-the-less.
I agree that preventing the browser to become unresponsive when loading bogus/malicious pages is a worthy objective but I don't see why the favicon needs to be singled out as a "bug".
These kinds of deny of service attacks against browsers have been known since, like, forever and they're basically impossible to completely prevent given the surface of attack and the complexity of modern web pages.
The favicon thing is just an annoying browser crashing bug. You could call that an "exploit" but up until fairly recently you were able to crash many browsers by generating too many message boxes (e.g. alert()) asynchronously.
So while, yes, it would be nice to fix it I don't really see it as being a high priority or one which will be actively exploited (since there is no "payoff" to either prankers or bad guys to this exploit).
A bad actor web-site can just move from favicon to an image, script file, or just return an indefinite series of HTML characters with no end.
The only way for the issue you want solved to be solved is for mobile browsers to add a "max page size" option, that will stop downloading content after it hits the cap.
In general this favicon bug is neither here nor there with the issue you're concerned about. Nobody needs this to waste your bandwidth.
The only reason this is noteworthy is that it is a little embarrassing for the browser vendors and it causes the browsers (Firefox and Chrome) to crash.