A developer recently uncovered an HTML 5 bug that could potentially allow users to be bombarded with gigabytes of useless data from rogue websites.
According to security researcher Feross Aboukhadijeh, both Windows and Mac (OS X) computers, along with a number of popular browsers are vulnerable to the flaw.
Indeed, the researcher says the data dumps to the user’s computer drive can be performed on most major browsers including Safari, Chrome, and Internet Explorer as well as Opera. The only major Internet browser to stop the data dump (thus far) was Firefox.
Aboukhadijeh explains that the flaw is rooted in the way HTML 5 handles local data storage, as each browser uses different storage parameters with user definable limits, with all allocating at least 2.5 MB of data to be stored on a user’s computer.
However, a method of bypassing the data limit exists. According to the security research, the work-around involves creating multiple temporary websites. Indeed, most of the major browsers don’t take this particular exploit into account, with each of the secondary sites allowed to load their own information up to the permitted user amount.
“Cleverly coded websites have effectively unlimited storage space on visitor’s computers,” Aboukhadijeh wrote in a blogpost.
The security researcher confirms was able to adopt 1 GB of data every 16 seconds on to the SSD inside his MacBook Pro computer, although the 32-bit browsers crashed before the disk was full. Aboukhadijeh says he has already sent a bug report to the makers of the browsers affected by the flaw – and is also offering up the relevant code snippets for a fix.
