How to bring down Internet Explorer with six words

7 August 2007

Thanks to Kelly Yancey, who found a Japanese Blog that discussed an interesting bit of HTML, it reminds me of the Doctor Who special called 'The Christmas Invasion', where the Prime Minister destroys the retreating Sycorax spaceship, much to the Doctor's annoyance.

The Doctor: Don't challenge me, Harriet Jones. 'Cause I'm a completely new man. I could bring down your Government with a single word.

Harriet Jones: You're the most remarkable man I've ever met. But I don't think you're quite capable of that.

The Doctor: No, you're right. Not a single word.

[pause]

The Doctor: Just six.

Harriet Jones: I don't think so.

The Doctor: Six words.

Harriet Jones: Stop it!

The Doctor: Six.

[approaches Alex, whispering in his ear]

The Doctor: Don't you think she looks tired?

How to bring down IE with six words...

... or more specifically five HTML tags and a CSS declaration:

<styl>*{position:relative}</style><table><input /></table>

In short, it sends Internet Explorer down in flames. IE is not known for great CSS support at the best of times, I suppose here that some piece of badly written code within IE did not expect the wildcard and so IE is going round in an infinite loop, causing a memory error or buffer overrun or one of these other horrible things that languages without inbuilt memory management are susceptible to.

Kelly reported that it was only IE6, however, I tested in IE7 and had a similar effect.

Start by opening this link. You get a webpage like this:

Step 1, we can have lots of fun.

Perhaps we are not worried yet, so far so good. However, now try to go somewhere else, say in a new tab:

Step 2 - there's so much we can do

Houston we have a problem.

1 gabe says...

ie does not crash with that link at all on vista but crashes on xp

Posted at 7:56 p.m. on August 7, 2007


2 Zeth says...

Thanks for that gabe. That is an interesting distinction. Are you opening the new tab? I wonder how Windows 2000 and 98 react. There are a lot of users still using those operating systems that do not get much in the way of updates.

I personally do not use Windows at all personally, besides testing websites when I use XP. I am currently avoiding Vista at the moment, although I'm sure I will need to have a test virtual machine one day (I make websites in my day job).

Posted at 8 p.m. on August 7, 2007


3 Phill says...

Oh, Internet Explorer is a joke. I found out the other day at work another little problem... a piece of JavaScript worked perfectly in Firefox, but not in IE. It turns out that IE has problems with dynamic radio buttons. Utter crap, for the most-used browser in the world. What annoys me is that these bugs are in IE7, not IE6. And, as far as I know, there is no website where bugs can be sent through. Bloody Microsoft, eh?

Posted at 9:45 p.m. on August 7, 2007


4 Phill says...

Note: What I meant by "in IE7, not IE6" above was not that the bugs weren't in IE6 at all (I don't know, they might have been), but just that they're in the latest version of the browser, one which is supposed to be standards compliant etc...

Posted at 9:46 p.m. on August 7, 2007


5 Jon says...

working web developer i have come to truly despise IE sometimes. I never had to much of a problem with it until i started working on sites that need to support down to IE5!!!

I've come across some really annoying IE bugs but luckily i spend 90% of my time working on the back-end (python FTW!) but that 10% i have to deal with the front end i hate because of IE.

Sorry for the little rant there. Anyway i don't hate IE completely just annoys me a lot.

When i read this earlier it just made me laugh and remember a bug i came across not to long ago. IE6 crashing when "window.onresize" is set and something is moved or resized using Javascript??!! that had me confused for a while

Posted at 11:23 p.m. on August 7, 2007


6 FiRe says...

Doesn't crash on XP x64

Posted at 11:28 a.m. on August 8, 2007


7 Zeth says...

How to bring down a server in six words?

Make it onto Slashdot!

http://it.slashdot.org/article.pl?sid=07/08/08/0212223

Funnily enough the server is still responsive in other ways, so the problem is with how Apache is configured. Or maybe having 3000 users within the first 10 minutes is always just a bit tough.

Posted at 11:33 a.m. on August 8, 2007


8 Lixas says...

does not crash on last xp 15 (XP pro processor IE 7) 32bit celeron mobile

Posted at 11:42 a.m. on August 8, 2007


9 Peter Flynn says...

It blows a freshly-installed IE6 out of X the moment it loads the page, using Crossover Wine under Ubuntu Edgy.

BTW your actual file differs from the one you quote. It actually reads:

*{position:relative}
(omitting the comment).

Posted at 12:10 p.m. on August 8, 2007


10 Paul Bowman says...

IE 7 crashes on Win XP 64bit!

Posted at 12:14 p.m. on August 8, 2007


11 Adam C says...

wowzerz! IE disappeared on XP SP2 x86 w/IE6. No crash message.

What would happen if this were embedded in a page with other harmless content?

Posted at 12:16 p.m. on August 8, 2007


12 Pepe says...

Wow, nice way to punish ie users, hehehee.

Posted at 12:24 p.m. on August 8, 2007


13 Peter Flynn says...

Adam C writes: > What would happen if this were embedded > in a page with other harmless content?

Why, then your page would be invalid HTML, and you wouldn't want that, would you? :-)

Posted at 12:32 p.m. on August 8, 2007


14 AxsDeny says...

It kills IE 5.0 on a fresh Win98 installation.

Posted at 12:46 p.m. on August 8, 2007


15 Cillian says...

Crashes IE 5.0 on Windows 2000 SP2... Go to the page, and straight away it crashes - no need to navigate to another page.

Posted at 12:47 p.m. on August 8, 2007


16 David Robinson says...

IE7 (7.0.6000.16473) in Vista Business (Intel Core2) crashes with the crash page open, when you open a new tab.

Not immediately, it takes a few seconds. Interesting find... :)

Posted at 12:55 p.m. on August 8, 2007


17 Ben says...

I put this on my myspace, because I hate it. It works crashing IE on my XP SP2 32-bit.

I opened the page in windows explorer - because silly microsoft allows that, and it crashed the desktop! woot!! i am loving this!

Posted at 1:03 p.m. on August 8, 2007


18 C says...

Crashes IE 6.0 on WIN 2000 on page load - no need to navigate to another page!

Very nice. I'll have to put this with the IE-detecting conditional comments and other bug-inducing code on my proof-of-concept website.

Posted at 1:21 p.m. on August 8, 2007


19 Georgi D. Sotirov says...

No crash on IE 7 (7.0.5730.11) on Windows XP Version 2002 SP 2.

Posted at 1:28 p.m. on August 8, 2007


20 Jivlain says...

If you have it stored on a XP machine, it will crash Windows explorer when you select it. No need to even open Internet Explorer!

Posted at 1:45 p.m. on August 8, 2007


21 Mikkel says...

Crashes IE7 on my windows XP laptop. Not right away, but after a few secs

Posted at 1:48 p.m. on August 8, 2007


22 Aaron says...

On my locked down work machine with XP and IE6, it just simply blows up when it tries to load that page. Doesn't even give me the "An error occured", or even loads up the page. It simply dies without saying a word.

Posted at 1:49 p.m. on August 8, 2007


23 Yoni says...

On ubuntu, under wine (with ies4linux), it crashes ie6 but not ie7.

Posted at 2:04 p.m. on August 8, 2007


24 Anon says...

Firefox 3 will freeze from an object element with a present but empty data attribute.

[object data=""] or even just [object data

Where [] are angle brackets.

Posted at 2:09 p.m. on August 8, 2007


25 Timothy says...

My IE crashes when attempting to play Windows Media Player streams. Grow the fcuk up. Do something important with your time. This is ridiculous

Posted at 2:11 p.m. on August 8, 2007


26 SillyUser says...

No problems for me.

Page loads, other pages load, life continues with no problems at all for my MSIE 7.

7.0.5730.11 on XP Pro SP2, fully patched.

Posted at 2:16 p.m. on August 8, 2007


27 tony says...

Hey I showed this to my friends and they said this is not a trick IE does this all the time :-)

Posted at 2:23 p.m. on August 8, 2007


28 SillyUser says...

Strike that comment!

Didn't realize it took 2-3 minutes to crash. Yet another reason to stick to Firefox....

Posted at 2:29 p.m. on August 8, 2007


29 ehrichweiss says...

Since no one else thought of it yet, IETab in Firefox will crash on that page, no need to navigate elsewhere.

This is on XP Pro SP2, Firefox 2.0.0.6(I think).

Posted at 2:34 p.m. on August 8, 2007


30 Conrad says...

At first, I though it would not crash, but I had not read the entire article: To see the crash you must open a new tab. I suspect most of the people who claim that IE 7 does not crash are not navigating anywhere.

Posted at 2:38 p.m. on August 8, 2007


31 noname says...

crashes rather nicely on my IE7 using Vista Home Premium (32bit)

Posted at 2:40 p.m. on August 8, 2007


32 rasmus says...

all we need now is a viscious script to make that page the startup page in IE...

finally the internet will be free!!

Posted at 2:49 p.m. on August 8, 2007


33 Cory says...

This is great. I've put this on my myspace page. Nobody with IE gets to see me now!

Posted at 3:04 p.m. on August 8, 2007


34 Rionn Fears Malechem says...

To keep IE users from viewing your page, all you need is an empty title tag. You can fill it in with script if you want a title. your content here

Posted at 3:24 p.m. on August 8, 2007


35 Manoj says...

My Windows explorer crashes too!! I created test.html file with those nasty 5 tags! when I click ( NOT double click) on the file, my Windows explorer crashed. So I was unable to open that file using IE.

Then I opened IE 6 and used File->Open->Browse to this test.html and You know what would have happened!

I was unable to delete that file, just by selecting and delete!!

Posted at 3:45 p.m. on August 8, 2007


36 rigbydt says...

Crashes IE7+ on Windows Vista Ultimate Edition a few seconds after opening a new tab. I get the "Internet Explorer has stopped working" dialog box.

Posted at 3:54 p.m. on August 8, 2007


37 James Darling says...

You are my hero. Destroying IE, whilst quoting Dr. Who? Awesomeness on a stick.

Posted at 4:19 p.m. on August 8, 2007


38 Cloudscout says...

So an asterisk causes it to crash? Maybe this should be called the "Barry Bonds Bug".

Posted at 4:31 p.m. on August 8, 2007


39 Roelant says...

I have no problems at all, my browser has no trouble rendering the page, even after a while.

Guess my Mac is defective.... :-)

Posted at 4:41 p.m. on August 8, 2007


40 narc says...

I got my 6.0 on XP SP2 to crash direcly on load. I couldn't even see the input border. Crash, crash, crash :)

Posted at 5:10 p.m. on August 8, 2007


41 kyle says...

crashed on load on my computer. ie v6 and windows media center

Posted at 5:32 p.m. on August 8, 2007


42 Doogie Mungster, MD says...

What amuses me are all the techies who go from bitching about old IE to talking about how they have to support it in their websites all in one breath... grow spines, or at least balls. If shitty websites stopped working in IE 5, people would have to upgrade. It's your own damn faults people still use it. Cliched though this may be, you're just like all those German citizens who became Nazis, because they lacked the self-confidence to say "no".

Posted at 6:17 p.m. on August 8, 2007


43 eric says...

Crashes my IE 7 on XP sp2 fully patched. Only when opening a new tab though

Posted at 6:27 p.m. on August 8, 2007


44 alert('uh oh')test says...

alert('uh oh')test

Posted at 6:29 p.m. on August 8, 2007


45 iball says...

IE sux. FF pwnz

Posted at 6:31 p.m. on August 8, 2007


46 More fun with IE and CSS » LonelyMachines says...

Hamachiya discovered this a few days ago, and it's repeated here.

Posted at 6:43 p.m. on August 8, 2007


47 Wing says...

Extremely cool bug. Tested it on my Windows system:

  1. Copy-n-paste url into the IE address field to load, will crash IE on load.
  2. Emailing the HTML file/document to myself via Outlook did not crash outlook. guess it's not using IE for the rendering?
  3. Saving the code to an html file will result in a IE/iexplorer crash, upon opening the file via double-click. Select, then right click to delete did not cause a crash. Perhaps because I don't have previewing/etc stuff turned on.
  4. would be interesting to see how this behaves if your activex desktop is setup to load this as one of the html/doc files to show on the desktop?

Posted at 7:44 p.m. on August 8, 2007


48 sholsinger says...

Screencap:

http://commandline.org.uk/images/posts/windows/hamachiya_ie_nocrash_ie7.gif

XP Pro (5.1.2600) x86 32bit IE7.0.5730.11 Update versions:0 - Doesn't crash, but will not re-render the tab. Mem usage stays within acceptable range: 21Mb - 32Mb.

Posted at 7:51 p.m. on August 8, 2007


49 Noxious bob says...

XP x86 causes Internet Exploder to crash and burn. No effect on IE7. W2K SP4 and IE 5.01.. no messages in fact it takes out Windows Explorer too.

Posted at 8:17 p.m. on August 8, 2007


50 Ray says...

Um... how does one find this out? There is no reason you would ever write that...

Posted at 8:34 p.m. on August 8, 2007


51 Dimiter says...

It crashes on Vista x64, both IE7 x86 and IE7 x64. For those of you who say it doesn't crash: try opening a new tab by clicking the 'new tab' minitab. It crashes nicely.

Posted at 5:24 a.m. on August 9, 2007


52 www.ilan.eu.org says...

Ubuntu 7.04 with wine and IE6

IE6 crashes

Posted at 5:38 a.m. on August 9, 2007


53 Tadeusz Szewczyk says...

Here I collected all 7 still working ways of crashing IE, at least in version 6: http://seo2.0.onreact.com/top-7-ways-to-crash-internet-explorer

Posted at 2:17 p.m. on August 9, 2007


54 OffBeatMammal says...

The problem is with the malformed tag and it's been around for quite a while

http://www.securityfocus.com/archive/1/319360/2003-04-20/2003-04-26/0

Posted at 6:05 p.m. on August 9, 2007


55 How to Kill IE7 in Windows Vista | PCTips Box says...

more nothing less. Is this all it takes to kill IE7? Well yes, just follow this link, courtesy of Commandline, and if the browser doesn’t crash immediately try opening a new

Posted at 12:21 p.m. on August 10, 2007


56 Vimk says...

Neat little exploit, but what would the html be to hide the box that results from it? Wouldn't do for non IE viewers to see a random input table...

Posted at 3:59 a.m. on August 12, 2007


57 Mike says...

I tried this on IE7 on Vista, when I opened a new tab and started typing a url it crashed. I don't know why it didn't work for Gabe but it certainly worked for me.

Posted at 9:14 a.m. on August 12, 2007


58 Eric says...

well, let's combine that with the Win98 + IE 4/5 bug that crashes the machine.

Posted at 11:47 a.m. on August 12, 2007


59 Justin Turner says...

Crashes IE6 running on WINE in Ubuntu Linux.

CRASH AND BURN INTERNET EXPLORER!

Posted at 5:26 a.m. on August 14, 2007


60 jaxsun says...

it doesnt crash ietab for firefox, HUZZAh

Posted at 8:04 a.m. on August 15, 2007


61 Thomas Wrobel says...

Opera handels it fine, of course. Seeing as they got important people that invented CSS on their team, its hardly supprising.

Posted at 11:16 a.m. on August 17, 2007


62 Adam Tuttle says...

It didn't crash internet explorer, but my Avast anti-virus detected it as a VBS virus. So it never had a chance to crash. Weird.

Posted at 10:48 p.m. on August 20, 2007


63 bobp says...

Tried to load in IE7 and Firefox on Vista:( with Avast! virus protection. It catches it as a VBS:Malware with the message:

VBS:Malware [Gen]" has been found in "http://hamachiya.com/junk/ie_crash.html

Posted at 6:21 p.m. on August 22, 2007


64 Caverna says...

Maxthon 1.5.9 crash too!!! :D

Posted at 11:53 a.m. on August 23, 2007


65 horsedrowner says...

it also crashes microsoft visual studio (2003) :P

Posted at 1:57 p.m. on August 23, 2007


66 Duckiputz says...

Well, it kills 7.0.5730.11 right away... on Win2k3 Server WTS.

Urgh!

Posted at 8:21 p.m. on August 29, 2007


67 Danny says...

Didn't do anything in IE7 XP edition.

Posted at 2:36 a.m. on September 3, 2007


68 fak3r says...

Fun stuff, kills IE6 in XP (at work) and IETab within Firefox! Plus, I think I found a new link for my sig files:

http://commandline.org.uk/more/microsoft/how-to-bring-down-internet-explorer-with-six-words-2007-08-07-19-18.html?showcomments=yes%3Cstyle%3E*{position:relative}%3C/style%3E%3Ctable%3E%3Cinput%20/%3E%3C/table%3E

Click on that link in IE, crash! Yea!

Posted at 9:17 p.m. on October 19, 2007


69 Rick B says...

I tested the code in Windows XP Pro SP2 under VMware. FireFox opened it fine, IE 6 crashes as expected. The surprising thing is IE 5.2 for Mac. Which was discontinued years back, opened the file fine just like FF.

Posted at 11:39 a.m. on April 4, 2008


70 Mark Szeman says...

Im having problems with a brand spanking new instalation of xp 64 , any program i open crashes as soon as i start typing , if i write what i want in notepad and copy it in it works , Im currently typing this on my MBP and i wish i had spent my cold hard cash on a mac pro now instead of a pc but does anyone have any idea what this could be , no viruses on my computer or any adware spyware etc etc .. im clean but the darn thing still keeps crashing ..thanks Bill.. Keep it up Mr. Jobs .

Posted at 10:55 a.m. on May 1, 2008


What do you have to say?

Show Editing Help

Europython

About

Hello, my name is Zeth, I'll be your host here.

Command Line Warriors is about taking control of your own technology, it looks at our experiences of computing; especially using GNU/Linux, the Python programming language, the command-line and issues such as techno-ethics, best practices and whatever is cool now. If you take control of your technology then you are a Warrior too!

This site is your site too which means that you can contribute and get involved. You can leave comments using the facility provided. For me, the comments and discussions are by far the best part of the site. So please do have your say!

Latest Discussions

gutes Qualitätscasino

July 3, 2009
The paragraph is the most basic block in a reST document. Paragraphs are simply chunks of text separated by one or more blank lines. As in Python, indentation is significant ...
An Introduction to ReStructuredText

sreejith

July 3, 2009
I want to download a file from remote server in binary format. Can anyone let me know the command to do so? Thanks in advance
PuTTY Series: Using PSFTP

jythlkedl;rg

July 2, 2009
????? ??? ????????? ?????? ?? ???????? ? ????????? ???, ? ??????? ??? ??????? ??????? ? ??? ?? ???? ?? ?? ????? ???????????????? ??????????????????. ??????????????????? ????? ?? ?? ????, ?, ???, ...
Burning an iso to CD on Windows

gbi-service-ru

July 1, 2009
???? ?????????, ?????????? ?? ?? ? ???"??? ??????, ?????????? ??? ?? ???? ? ????, ? ? ?????. ?? ??? ???? ???? ??? ???. ?? ?????????? ???? ?? ?. ???????? ?, ...
Burning an iso to CD on Windows

seo techniques

July 1, 2009
I would like to thank you for the inforamtion you have put on this article no matter.
Only the penitent man will pass - on captchas and cotton wool

Online Craps lernen

July 1, 2009
I would like to thank you for the making these clarifications in such a detailed manner to rebuilt the communication and enhancing the strategies of the organization which could be ...
Disclaimer: NO WARRANTY

ZK@Web Marketing Blog

July 1, 2009
Django is an amazing web framework; we built a lot of features in a very short period of time and Django [mostly] stayed out of our way. Last night as ...
Baby Steps with Django - Part 4 Django Applications and flow

overnight payday loans

July 1, 2009
I found commandline.org.uk very informative. The article is professionally written and I feel like the author knows the subject very well. commandline.org.uk keep it that way.
Only the penitent man will pass - on captchas and cotton wool

Drogo

June 30, 2009
Gotta agree with your sentiments about many modern games. The cost of a new game is prohibitive, especially for consoles (although I've noticed that PS2 games have crashed in price ...
Retro British Gaming - Part 3: Amstrad CPC Games

pppiohooddd

June 29, 2009
Free vadult video site! http://crech.us/ 1000 free video every day!
OpenSolaris, Gobuntu, and be careful who you kiss

Tesyimasystus

June 29, 2009
...Love this dude!!! http://www.esnips.com/doc/79c22395-7bd6-4299-92db-cf392e381698/kutiman---this-is-what-it-became Peace
5 Homebrew Python Games

Simon Tite

June 28, 2009
twitterfall is still there, I just tried it, and to me it beats Visible Tweets hands down. Problem with Visible Tweets: * Extremely **irritating** animations! (There are three available, but ...
Visualising your favourite keywords in Twitter

piffAltetle

June 28, 2009
??? ??? ???? ???????????? ??????,?????????? ???? ?????? ??????????? ???????,??????????? ????? mp3,??????? ??????????? ??????.
Encrypt your /home this Christmas: part three - moving your data to the encrypted partition

idhyougjdsyhfr

June 26, 2009
SMS Trap is something that never fails to help you get your partner off guard? Our software will make reading other people?s SMS as easy as ABC. Ready for some ...
Burning an iso to CD on Windows

Sozdanie-saitov-com

June 26, 2009
???? ???????? ? ?????????????????? ????????????? - ??? - ???? ?? ????? ?????. ???? ?? ??? ? ??????? ?????? ????????? ?????! ???, ?????23126 sozdanie-saitov.com@mail.ru
Burning an iso to CD on Windows

gameskillz

June 26, 2009
Killzone 2 - the best PS3 game yet?Still LittleBigPlanet for me, but Sony's new shooter is mightily impressive. What you think about my web? http://www.easyfaxlesspaydayloan.com/payday-loans-online.html
Email Syntax Check in Python

Anish

June 25, 2009
hey Moritz, Check this http://commandline.org.uk/python/my-merry-five-minutes-with-bazaar/
Setting up a bazaar server

gbi zavod 177

June 24, 2009
???? ?????????, ?????????? ?? ?? ? ???"??? ??????, ?????????? ??? ?? ???? ? ????, ? ? ?????. ?? ??? ???? ???? ??? ???. ?? ?????????? ???? ?? ?. ???????? ?, ...
Burning an iso to CD on Windows

vettone

June 24, 2009
??? ????? ????? ????,??????? ?? ???,????? ???? ???.????? ?? ??????????? ????,?????????? ?????? ???????? ?? ????.???? ????????: http://euro-football.ucoz.com ????? ???? ??????????.
Burning an iso to CD on Windows

tuegjhg78kjfhuey

June 23, 2009
? ???????????????? ???? ??? ???, ?? ?????? ?? ?????????, ???, ???????????????? ??? ??????????, ???? ????? ??? ??? http://remont.ucoz.ua/
Burning an iso to CD on Windows