This 13-Character String Will Kill Chrome Dead – But Only on OSX

22.03.2015 Nate Hoffelder 3 Comments

Monty Python’s world’s deadliest joke might be a work of fiction, but Chrome has a flaw which is just as deadly.

VentureBeat reports that a newly discovered bug in the Chrome web browser has the potential, like the world’s deadliest joke, to kill Chrome browser tabs.  The bug is a 13-character string which, when loaded on a web page, crashes the tab.

Here’s an image of the characters:

This bug doesn’t work on the Windows or Android versions of Chrome (or in any other web browser), but it does reportedly crash the OSX version of Chrome.

It’s not clear why the string crashes Chrome or what it says, but after some Googling I can report that the language appears to be Aramaic. A couple of the words were found in what I _think_ is the Aramaic section of Wikipedia, and the characters resemble characters in a sample image on the related language page in Wikipedia.

I’m trying to contact the original bug finder in order to get some background, but all I have right now is the sparse but amusingly straightforward bug report:

What steps will reproduce the problem?
1. Any page with [removed so this article loads for everyone] will crash the Chrome tab on a Mac
2. Just create any dummy page with the unicode characters, and the Mac Chrome tab will crash hard

What is the expected result?
Expect it not to crash

What happens instead?
It crashes

I don’t have a Mac myself, but VentureBeat says that they tested the bug and can confirm that it does happen – most of the time.

In a few cases, the characters fail to render and users instead see 13 blank rectangles (????? ??? ?????). In my experience, those rectangles are only shown when a web browser tries to display characters using a font which it doesn’t support.

Fonts are a tricky thing, and this isn’t the first time that a unique string of characters has crashed an app. I recall that back in 2013 a developer identified a gibberish string of Arabic characters which could crash any OSX or iOS app which used Apple’s CoreText API to render text.

Ars Technica reported at the time that the bug affected many apps, including Chrome, but only apps which relied on Apple to render the font. Firefox, for example, was immune.

I missed that bug two years ago, and I am financially secure from encountering the current bug, but I would be interested in reading any first-hand accounts.

Have you encountered either bug? Did it crash your web browser?