Security Advisor

HTML 5 Hole Could Fill Hard Drive with Junk Data

Clicking on a Web site could cause your hard drive to be filled with unwanted and harmful data in a short period of time.

A security researcher revealed a discovered HTML 5 flaw last week that could allow attackers to perform data dumps by users of many popular Web browsers, including Internet Explorer, Google Chrome, Opera and Apple's Safari Web browser.

According to 22-year-old researcher Feross Aboukhadijeh, the vulnerability is due to the browsers mentioned not following the rules laid out by the World Wide Web Consortium (W3C) that states, " User agents should guard against sites storing data under the origins other affiliated sites, e.g. storing up to the limit in,,, etc, circumventing the main storage limit."

"However, Chrome, Safari, and IE currently do not implement any such 'affiliated site' storage limit," said Aboukhadijeh in a blog post. "Thus, cleverly coded websites, like, have effectively unlimited storage space on visitor's computers."

Aboukhadijeh has found a way to bypass the data limit by creating multiple temporary "affiliate" Web sites that can be used to inject a system with large amounts of data. In a proof-of-concept demo, he illustrated this by inserting a large amount of cat images on a system  (and, of course, due to it being the Internet, had to pair the cat images with the overused, yet still amusing Trololo song).

While Aboukhadijeh explained that due to the  HTML 5 data limit workaround, those using any of the affected Web browsers could eventually have their entire hard drive filled with unwanted data, he found the process takes much faster on a Macbook Pro Retina with a solid state drive (SSD) -- up to 1 GB of data can be injected every 16 seconds.

Due to how Mozilla caps data in its Firefox Web browser, it is immune to the flaw.

In true fashion that is the morally ambiguous life of a security researcher, Aboukhadijeh has both reported the flaw to the Web browser makers and has released the code for you and your friends to fill up others' hard drives with silly cat pictures (or it could be used for more nefarious purposes). Thankfully, so far there has been no word of the flaw being exploited in the wild.

About the Author

Chris Paoli is the site producer for and


  • Microsoft Warns SameSite Cookie Changes Could Break Some Apps

    IT pros could face Web application issues as early as next month with the implementation of a coming SameSite Web change, which will affect how cookies are used across sites.

  • Populating a SharePoint Document Library by E-Mail, Part 1

    While Microsoft doesn't allow you to build a SharePoint Online document library using e-mail, there is a roundabout way of getting the job done using the tools that are included with Office 365. Brien shows you how.

  • Microsoft Previews New App Reporting and Consent Tools in Azure AD

    Microsoft last week described a few Azure Active Directory improvements for organizations wanting to connect their applications to Microsoft's identity and access service.

  • Free Software Foundation Asks Microsoft To Release Windows 7 Code

    The Free Software Foundation this week announced that it has established a petition demanding that Microsoft release its proprietary Windows 7 code as free software.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.