#### VULNERABILITY DETAILS
From /third_party/WebKit/Source/core/loader/FrameLoader.cpp:
```
void FrameLoader::startLoad(...)
{
ASSERT(client()->hasWebView());
if (m_frame->document()->pageDismissalEventBeingDispatched() != Document::NoDismissal)
return;
(...)
m_frame->document()->cancelParsing();
detachDocumentLoader(m_provisionalDocumentLoader);
// beforeunload fired above, and detaching a DocumentLoader can fire
// events, which can detach this frame.
if (!m_frame->host())
return;
m_provisionalDocumentLoader = client()->createDocumentLoader(m_frame, request, (...));
(...)
m_provisionalDocumentLoader->startLoadingMainResource();
(...)
}
```
Detaching the provisional document loader can trigger load event handlers that may reenter FrameLoader::startLoad and attach a new provisional loader. After |detachDocumentLoader| returns, the pointer to the new loader is immediately overwritten. As a result, the abandoned loader will remain attached to the frame for the duration of its lifetime, which allows an attacker to escape from FrameLoader::prepareForCommit without the risk of canceling the load.
#### VERSION
Chrome 51.0.2704.54 (Beta)
Chrome 52.0.2739.0 (Dev)
Chromium 52.0.2742.0 (Release build compiled today)
京公网安备 11010502034610号
暂无评论