Over 60 themes added to the filebase.

However, the people saying that Apple was quicker to fix the problem than Google are only telling half the story. Apple introduced the security flaw and knew about it for two months before fixing it. Apple left a "passwords being sent in cleartext" bug in OS X Server for six months after it had been fixed upstream. There is also a local root exploit in desktop OS X, that only requires a single line of Applescript to trigger, that has been around for years and has not even been fixed in development versions of Snow Leopard.

In addition, the original iPhone shipped with an old version of Webkit that contained a similar flaw, when the Mac version of Safari had fixed it. This was a flaw that had been fixed in Internet Explorer 6 literally years beforehand, and we all know that it's rare for IE 6 to rightly claim security superiority :-P

I infinitely trust Google more with web software than Apple, but not if they use Apple code in it.

I tried it my self, yes there is a security problem. i think google will fix it soon.

thanx for info

This "security flow" it have been already PATCHED. there is a new version 0.2.149.29

Well For apple took two month to fix his flaws.. for Google took about what...? two days ?

http://www.computersake.com/2008/09/google-chrome-save-as-function-buffer-overflow-vulnerability/

Hey, why not go the whole hog? Turn off your computer and go live in a cave. So it ain't perfect? What is?

Live in total fear and total safety - or live a little, take a few minor risks, and get the benefit.

This 'flaw' requires not only the use of Chrome - but also a 'newbie level' of carelessness.

It need not be serious, it will be fixed, no need to knot the underwear.

1. As always, be smart about your browsing.

2. Go into your settings and disable auto-download (I did it as soon as I got the browser).

This may have been posted already, but I CBA to read everything :)

However, you can temporary overcome this prob in Chrome. Go to "Option > Minor Tweaks" and check the box "Ask where to save each file before downloading" under the "Download location" section. Like this, every time when you are downloading files (automated or you click on it), there will be a dialog box asking you where to save the file. You can click cancel if you found out the file is weird.

and as a final point, lookup what a security flaw is, plenty of info on that for IE and Safari, then google define:dumbass and youll find a picture of yourself for not being able to tell the difference between what someone else is doing right and your doing wrong

tata

But for sure, they fix this much sooner.

Google claims to only employ the best of the best but it took a 9 to 5 journalist less than a few hours to find vulnerabilities in the Chrome product. Well it only gets to show you that Groucho was right after all...you never know who is blessed with common sense or not.

Above, somebody said Chrome is self-updating. Does this mean it updates its versions automatically on the fly, behind the scenes, without prompting the user?

(posted via g. chrome)

I did notice earlier today that while I was browsing Facebook, Chrome automatically downloaded the file us-120other.html twice. Not sure what it is or why it was downloaded.

Looking into it I see (curlys to simulate html brackets):

{script 
type="text/javascript" src="http://Ads1.msn.com/library/dap.js" }
{/script}
{script 
type="text/javascript"}
dap('&PG=FBK600&AP=1113', 120, 600);
{/script}
{img src="http://ads.ak.facebook.com/ads/creative/1x1/msn/us-120other.gif" height="1" width="1" border="0"}

Pretty soon people are going to think opening a web page is a flaw.

Jish
www.privacy.mx.tc

http://www.milw0rm.com/exploits/6355

If a user is stupid enough to click the download button in Chrome, they will surely be stupid enough to just double click the "executable" in their downloads folder too.

Its exactly the same as opening an email attachment. I dont see how it has anything to do with Chrome at all, unless your suggesting Chrome should block running programs that have been downloaded ? - Thats just denial of responsibility though, not security.

On my system it does nothing, becuase the choice of what to do with an "executable" file is up to Windows, and i have the ".jar" extension registered to an archive program, since jars are just zip files anyway.

I configure my browsers to "Always ask where to save a downloaded file". Thus in my case I get the save as dialog before any download actually occurs.

It actually took me a moment to even see what the big deal was, then I remembered that by default the file is just saved to your desktop.

Is this a usability issue? YES. Google will need to add prompts and/or make it obvious that the download bar is not part of the window.

1. if you're not prepared to take the risk then don't install it (it's not compulsory), and let those of us who do like it get on and enjoy it in peace.

2. it is open source. if you don't like it, patch it yourself.

I wrote more about this idea here:

Google Chrome: Disruptive Technology
http://faseidl.com/public/blog/212172

But don't forget, lots of Google's products and services stay in "Beta" forever. They can't continue to hide under that. Google has effectively made "Beta" into "release/stable" for themselves. They don't really deserve any extra slack because of the Beta label like an independent developer might. They need to properly use the term if they want the slack from users it should provide.

In a BETA piece of software. As in unfinished, use at your own risk, not ready for the primetime.

These will be corrected in the final version I guess..

Good and nice post

Cheers, Nag