Crashing Windows 7 and 8 with html

[w1z4rd]

I have not tested this, so if someone has a VM or PC they want to donate to a good cause to test, please let us know the results. Its not malicious, its just apparently causes the windows 7 machine to crash. Since I do not dev on windows 7 I can not test this myself.

Create a normal html document, with basic tags (head, title, body, html) and then in the body of the html just include the following type of image src:

<img src="C:\$MFT\ishouldhaveusedwindows10.jpg">

you can call the image anything you want as long as you src it from c:\$MFT\

Thankfully this only works in Internet Explorer or Firefox. Chrome users are safe. However, upload this html file to any server and you can get people who fit the right conditions (running win7, win8 & win8.1 + Firefox or internet explorer) to remotely crash their pc.

If you test this, please let me know the results here. Is it an insta crash? etc

 

[grump_grouch]

Interesting.

Set up a new Win7 VM. Did some customisation (background, folder views, etc.) and then created an empty .html file, opened it in Notepad and typed in some basic HTML (with the img tag), saved it and then opened it in IE. Could still switch between current open windows but not much else.

Rebooted the VM and everything was back to the way it was before the customisation. Even the .html file was empty again. Typed in the HTML again, saved the file and then rebooted Windows to make sure everything stayed as I have set it. Opened task manager and then opened the .html in IE again. Same symptoms - could switch between open windows but nothing else. Could switch to task manager and tried to end process tree for iexplore.exe and explorer.exe (for good measure). Gave me "Access denied" - and yes, the user has admin rights .

Rebooted (reset) again and working normally.

 

[murray654]

Create a normal html document, with basic tags (head, title, body, html) and then in the body of the html just include the following type of image src:

<img src="C:\$MFT\ishouldhaveusedwindows10.jpg">

you can call the image anything you want as long as you src it from c:\$MFT\

Thankfully this only works in Internet Explorer or Firefox. Chrome users are safe.

I tested with both Chrome and Iron browser (Chromium) and the win7 system was pretty much useless. Could not start any program, and could not shut down system.

More on this

Reported in May... The system I was testing on has not been on internet in a long while, so is missing recent updates... I wonder if Microsoft addressed this recently.