

IE8/9 crash with CSS only - schinken42
http://schinken.github.io/experiments/iecrash/
Attention: this link can crash your IE!<p>See an explanation here: http:&#x2F;&#x2F;www.hackerspace-bamberg.de&#x2F;Benutzer:Schinken&#x2F;CSS-IE-Crash<p>Maybe someone can change the URL for this entry... looks like i can&#x27;t ;)
======
lojack
This is most likely a hang and not a crash. The difference is a hang is highly
unlikely to lead to anything exploitable and if its obscure enough, Microsoft
will almost certainly not fix it in older versions of their browser.

I've found a similar one a few months back. Please note that this will also
crash your browser...

[https://gist.github.com/lojack/6510214](https://gist.github.com/lojack/6510214)

~~~
beeglebug
Looks very similar to the one I recreated a while ago, something to do with
dotted borders and border-radius:

[http://codepen.io/beeglebug/pen/ntLbv](http://codepen.io/beeglebug/pen/ntLbv)

------
_kushagra
I made safari crash with CSS only too!
[http://cssdeck.com/labs/adbir40g](http://cssdeck.com/labs/adbir40g)

------
egeozcan
Internet Explorer 10's emulation seems to be really dedicated: It crashes on
IE8 mode. No luck with IE9 mode though.

~~~
eli
I remember with IE9 developers were mad that Microsoft fixed some bugs in its
IE8 emulation. Which was a problem for those css "hacks" that relied on bugs.
Guess they can't win :)

~~~
yuhong
I actually reported a security bug that MS fixed by making real IE6/IE7 match
IE8's IE7 emulation: [http://yuhongbao.blogspot.ca/2013/07/how-i-found-
cve-2013-13...](http://yuhongbao.blogspot.ca/2013/07/how-i-found-
cve-2013-1310.html)

------
darkchasma
I know I'm being overly pedantic, but it's not actually CSS that's crashing
the browser, it's Micrsoft's extension that is the culprit.

------
schinken42
Attention: this link can crash your IE!

See an explanation here: [http://www.hackerspace-
bamberg.de/Benutzer:Schinken/CSS-IE-C...](http://www.hackerspace-
bamberg.de/Benutzer:Schinken/CSS-IE-Crash)

Maybe someone can change the URL for this entry... looks like i can't ;)

------
brickmort
yup, that definitely crashed my IE. I'm not quite sure what I expected.

~~~
zeckalpha
Maybe this should be a link to a page explaining it which has a warning and a
link to this page, instead of directly linking.

~~~
schinken42
fixed :)

------
013
Win7 Pro - IE9. IE Would still work, although it's stuck on that tab, and it's
like my mouse is stuck highlighting, so when I move my mouse, it highlights
part of the page. I had another tab that auto reloads, and I can still see
that reloading, although I can't click on it. I also can't click on the _ [] X
buttons.

------
flixic
If you don't care about old IE visitors and hate their browser, this sounds
like a good way to convince them that their browser is terrible.

Normally I wouldn't feel this way, but recently had to spend days adding CSS
hacks and making sure design works on IE 7, and my hate was reborn again.

~~~
eli
That sounds kinda malicious and not at all like a good idea.

If you don't want to support old IE, then don't support it. If you have to
support it because enough of your customers still use it, then why would you
want their browser to crash?

~~~
blktiger
It's a terrible idea, although if every website started including stuff like
this then users might complain enough for IT shops to relax their stupid
restrictions and allow them to use a more modern browser. :P

~~~
eli
I'm confident that most of the people using e.g. IE7 are already quite aware
that their browser sucks. I think their life is hard enough already without
people intentionally messing with them.

------
mproud
Microsoft won’t fix it. (The author submitted the report months ago.)

But who cares, as IE10 supports CSS3 gradients… right?

------
ceautery
Chris, I think "drawn", not "drawed" is what you were looking for.

Also, nice find.

------
steven777400
IE 8 on Windows 7 became completely non-responsive and consumed an entire CPU
until terminated.

------
vezzy-fnord
Reminds me of all those legacy bugs in IE6 that achieved the same result, or
RSnake's crash that involved an insane HTML width attribute.

But hey, it took until IE9 to pass Acid3. Who knows what's in Trident?

~~~
stevekemp
In 2005 I reported a crashing bug with large iframe widths/heights in mozilla:

[https://bugzilla.mozilla.org/show_bug.cgi?id=292279](https://bugzilla.mozilla.org/show_bug.cgi?id=292279)

Sadly no bounty for me!

------
300bps
I tested this with IE9 on Windows 7 Pro and it did not crash. I clicked on the
Crash Me button, moved the cursor all around, refreshed the page, etc. No
crash.

~~~
schinken42
maybe this only works on a windows xp machine..

Microsoft confirmed that bug:

[https://connect.microsoft.com/IE/feedback/details/790265/com...](https://connect.microsoft.com/IE/feedback/details/790265/combination-
of-filter-and-first-letter-text-transform-uppercase-freezes-ie8-9)

"Cash Me" is no button even if it looks like one ;)

~~~
CWIZO
IE9 does not run on XP.

------
aestra
I had to click inside the "Crash me" box to get IE to hang.

------
detay
funny. IE crashed before I tried the link.

------
taternuts
Win7 64 Bit IE8 Hung, IE9 was OK

------
ttty
Crashed IE8, win xp, 32bit

------
nraynaud
isn't this kind of stuff subject to responsible disclosure?

~~~
schinken42
Closed from microsoft as "wont fix"
[https://connect.microsoft.com/IE/feedback/details/790265/com...](https://connect.microsoft.com/IE/feedback/details/790265/combination-
of-filter-and-first-letter-text-transform-uppercase-freezes-ie8-9)

~~~
nraynaud
So I guess it's fair game.

------
BaconJuice
No crash in IE7?

