#### VULNERABILITY DETAILS
FrameLoader::loadInSameDocument is vulnerable to a problem similar to the one described in issue 613266:
```
void FrameLoader::loadInSameDocument(const KURL& url, (...))
{
(...)
// If we have a provisional request for a different document, a fragment scroll should cancel it.
detachDocumentLoader(m_provisionalDocumentLoader);
if (!m_frame->host())
return;
(...)
}
```
Calling FrameLoader::startLoad in the middle of detaching |m_provisionalDocumentLoader| will cause the new provisional loader to be cleared prematurely. In this case, |m_provisionalDocumentLoader| isn't set up afterwards, so the attacker has to take care of it explicitly after the hash navigation in order to avoid crashes.
#### VERSION
Chrome 51.0.2704.79 (Stable)
Chrome 52.0.2743.24 (Beta)
Chrome 53.0.2756.0 (Dev)
Chromium 53.0.2760.0 (Release build compiled today)
暂无评论