IE8/9 crash with CSS only(schinken.github.io)
schinken.github.io
IE8/9 crash with CSS only
http://schinken.github.io/experiments/iecrash/
39 comments
Microsoft won’t fix it. (The author submitted the report months ago.)
But who cares, as IE10 supports CSS3 gradients… right?
But who cares, as IE10 supports CSS3 gradients… right?
Chris, I think "drawn", not "drawed" is what you were looking for.
Also, nice find.
Also, nice find.
Reminds me of all those legacy bugs in IE6 that achieved the same result, or RSnake's crash that involved an insane HTML width attribute.
But hey, it took until IE9 to pass Acid3. Who knows what's in Trident?
But hey, it took until IE9 to pass Acid3. Who knows what's in Trident?
In 2005 I reported a crashing bug with large iframe widths/heights in mozilla:
https://bugzilla.mozilla.org/show_bug.cgi?id=292279
Sadly no bounty for me!
https://bugzilla.mozilla.org/show_bug.cgi?id=292279
Sadly no bounty for me!
I had to click inside the "Crash me" box to get IE to hang.
isn't this kind of stuff subject to responsible disclosure?
Closed from microsoft as "wont fix" https://connect.microsoft.com/IE/feedback/details/790265/com...
So I guess it's fair game.
Only if it's exploitable. This seems to be a hang, which doesn't constitute an exploitable vulnerability, just an annoyance.
I tested this with IE9 on Windows 7 Pro and it did not crash. I clicked on the Crash Me button, moved the cursor all around, refreshed the page, etc. No crash.
I did some testing:
Win7/IE8: froze
Win7/IE9: froze
Win7/IE10: nothing
Win8/IE10: nothing
S2003/IE8: froze
S2008/IE8: nothingCertainly crashed my Vista (real machine).
I got it to hang on IE10 running the "Browser Mode: IE8" emulator.
I had the same results on Windows 7 / IE9 no crashing
maybe this only works on a windows xp machine..
Microsoft confirmed that bug:
https://connect.microsoft.com/IE/feedback/details/790265/com...
"Cash Me" is no button even if it looks like one ;)
Microsoft confirmed that bug:
https://connect.microsoft.com/IE/feedback/details/790265/com...
"Cash Me" is no button even if it looks like one ;)
IE9 does not run on XP.
yup, that definitely crashed my IE. I'm not quite sure what I expected.
Maybe this should be a link to a page explaining it which has a warning and a link to this page, instead of directly linking.
fixed :)
Attention: this link can crash your IE!
See an explanation here: http://www.hackerspace-bamberg.de/Benutzer:Schinken/CSS-IE-C...
Maybe someone can change the URL for this entry... looks like i can't ;)
See an explanation here: http://www.hackerspace-bamberg.de/Benutzer:Schinken/CSS-IE-C...
Maybe someone can change the URL for this entry... looks like i can't ;)
I made safari crash with CSS only too! http://cssdeck.com/labs/adbir40g
Crashed IE8, win xp, 32bit
IE 8 on Windows 7 became completely non-responsive and consumed an entire CPU until terminated.
I know I'm being overly pedantic, but it's not actually CSS that's crashing the browser, it's Micrsoft's extension that is the culprit.
This is most likely a hang and not a crash. The difference is a hang is highly unlikely to lead to anything exploitable and if its obscure enough, Microsoft will almost certainly not fix it in older versions of their browser.
I've found a similar one a few months back. Please note that this will also crash your browser...
https://gist.github.com/lojack/6510214
I've found a similar one a few months back. Please note that this will also crash your browser...
https://gist.github.com/lojack/6510214
Looks very similar to the one I recreated a while ago, something to do with dotted borders and border-radius:
http://codepen.io/beeglebug/pen/ntLbv
http://codepen.io/beeglebug/pen/ntLbv
Calc() will also crash IE9 when there's a bg image present (on focus)
http://jsfiddle.net/874Bq/2/
http://jsfiddle.net/874Bq/2/
Win7 64 Bit IE8 Hung, IE9 was OK
Internet Explorer 10's emulation seems to be really dedicated: It crashes on IE8 mode. No luck with IE9 mode though.
I remember with IE9 developers were mad that Microsoft fixed some bugs in its IE8 emulation. Which was a problem for those css "hacks" that relied on bugs. Guess they can't win :)
I actually reported a security bug that MS fixed by making real IE6/IE7 match IE8's IE7 emulation:
http://yuhongbao.blogspot.ca/2013/07/how-i-found-cve-2013-13...
If you don't care about old IE visitors and hate their browser, this sounds like a good way to convince them that their browser is terrible.
Normally I wouldn't feel this way, but recently had to spend days adding CSS hacks and making sure design works on IE 7, and my hate was reborn again.
Normally I wouldn't feel this way, but recently had to spend days adding CSS hacks and making sure design works on IE 7, and my hate was reborn again.
If their browser only crashes on your page, they're not going to conclude that their browser is the problem - they're going to conclude that your page is the problem.
That sounds kinda malicious and not at all like a good idea.
If you don't want to support old IE, then don't support it. If you have to support it because enough of your customers still use it, then why would you want their browser to crash?
If you don't want to support old IE, then don't support it. If you have to support it because enough of your customers still use it, then why would you want their browser to crash?
It's a terrible idea, although if every website started including stuff like this then users might complain enough for IT shops to relax their stupid restrictions and allow them to use a more modern browser. :P
I'm confident that most of the people using e.g. IE7 are already quite aware that their browser sucks. I think their life is hard enough already without people intentionally messing with them.
No crash in IE7?
Win7 Pro - IE9. IE Would still work, although it's stuck on that tab, and it's like my mouse is stuck highlighting, so when I move my mouse, it highlights part of the page. I had another tab that auto reloads, and I can still see that reloading, although I can't click on it. I also can't click on the _ [] X buttons.
funny. IE crashed before I tried the link.
See an explanation here: http://www.hackerspace-bamberg.de/Benutzer:Schinken/CSS-IE-Crash
Maybe someone can change the URL for this entry... looks like i can't ;)