Chrome Bug No Security Threat, Argues Google

Google's Chrome contains a critical vulnerability that under certain circumstances allows attackers to plant malware on a Windows PC, a security company said last week.

According to Slovenia-based Acros Security, Google would not categorize the bug as a vulnerability, and instead called it a "strange behavior that [they] should consider changing."

The vulnerability, said Mitja Kolsek, Acros' CEO, is one of a string in Windows programs that relies on an attack strategy variously dubbed "DLL load hijacking," "binary planting" and "file planting." The attack jumped into public view in August 2010 when HD Moore, the creator of the Metasploit penetration hacking toolkit and chief security officer at Rapid7, found dozens of vulnerable Windows applications. Moore's report was followed by others, including several from Kolsek and Acros.