Popular web browser by Google, see chrome.google.com for more information.

learn more… | top users | synonyms

23
votes
2answers
4k views

Why I am getting Facebook login pop up for every site?

My Chrome browser keeps prompting me for Facebook authentication, even though I have never logged on to Facebook from my PC. I am using Chrome browser from my company where they have a strong proxy ...
2
votes
2answers
52 views

Is QUIC (Quick UDP Internet Connections) safe to allow through firewall?

Our firewall currently blocks QUIC (UDP 443) traffic which seems to be enabled by default in Google Chrome. Is it safe to allow QUIC or should I wait until it is implemented in all the major browsers? ...
1
vote
2answers
40 views

Security of Chrome's Printing Output

On Linux systems the printing functionality of Chrome (printing of websites or PDF documents) generates PDF documents which are sent to the print server (e.g., CUPS). Are there any security mechanisms ...
4
votes
3answers
99 views

Could Google Chrome's lack of a download confirmation dialog be a security vulnerability?

Suppose the user is playing a game like flappy bird that requires constant tapping in the lower left area of the screen (where the downloaded file needs to be clicked). Then while the user is ...
0
votes
1answer
72 views

mail.ru and slightsearch.ru hijacking browser default search engine set by admin

I recently got malware installed on my PC that contained software that infected my google chrome, by hijacking my default search engine. I tried: Removing newly installed programs from PC, using ...
1
vote
1answer
235 views

Chrome 50: Where can I see the negotiated cipher suite?

This is about Chrome 50. When visiting an https site, where can I find the negotiated cipher suite? I know where to find this info in previous versions of Chrome but I'm not able to find it in the ...
4
votes
2answers
81 views

Why would a modern browser allow internal resources to be loaded from an external page

Recently someone announced that several Arris surfboard models lacked any form of authentication to perform functions such as reboot and factory reset a modem with a single http call. Read more on ...
1
vote
2answers
35 views

Random autofill [closed]

I was trying to pay for something just now, and when I put my name in the chrome autofill came up and I clicked it. The address that showed up was wrong though but corresponded to the postcode of one ...
4
votes
2answers
187 views

How do I protect my passwords from WebBrowserPassView?

I just got shocked with what can be achieved with WebBrowserPassView. It basically shows every password I've saved in my browser (Chrome). I guess other users on my PC could get my passwords that ...
3
votes
1answer
38 views

Can going to a bad website on firefox, or installing a malcious firefox plugin, infect other parts of my home folder on a Linux system?

BTW, I don't mean root, just a plain user. I'm worried because I'm scared that if I do such things I could infect my Chromium folder. I got a huge case of OCD.
1
vote
0answers
39 views

Have there been any known “in the wild” exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
0
votes
2answers
67 views

Malware or viruses by browser redirects?

Recently was browsing and clicked on a link to the following address: (In code blocks so you cant accidently click it) http://paycheck-calculator.org/ Clicking on this quickly loaded 2-3 different ...
3
votes
2answers
71 views

SSL browser session keys

I am trying to export/write the SSL master secret and keys to a file from the chromium browser. I would appreciate if someone could advice me how to do this. To write the premaster secret we can ...
12
votes
2answers
1k views

Google Chrome says “Your connection to example.com is encrypted using an obsolete cipher suite.”

I get following info when I click on lock icon on address bar: I have couple of questions: Q1. What are the security concerns here? Q2. Even after 'obsolete cipher suit' message, Chrome is able ...
3
votes
1answer
103 views

Firefox & Chrome Strong Ciphers

Of the following ciphers for RSA authentication, Firefox and Chrome do not use stronger than ECDHE-RSA-AES128-SHA256. ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD ...
64
votes
13answers
9k views

Should I allow browsers to remember my passwords and synchronize them?

I wonder, how wise is it to allow Chrome and Firefox to a) remember the passwords b) synchronize them? My gut tells me that if it's not man in the middle who can intercept them, but Google and Mozilla ...
0
votes
2answers
96 views

Can Chrome browser history be seen on work wifi, even if not re-loaded?

I use the work wifi daily but am always conscious of using work related sites. However Android tends to keep most apps running in the browser so my windows(tabs) are never essentially closed down. ...
0
votes
2answers
93 views

Are there any consequences of clicking on a URL to a facebook.com link?

So I stupidly clicked on a suspicious link on a Facebook post today. Guest account for shame. In my defense, it was a link to facebook.com itself, but it loaded a Facebook page, then seemed to ...
1
vote
3answers
138 views

Can Google Chrome read/scan my ProtonMail inbox page?

If I used Google Chrome to visit ProtonMail website, it would not be difficult for Google to read my emails since it would just need to scan/read the content of the page. Messages are encrypted just ...
1
vote
1answer
105 views

AirVPN, DNS Leaks on Windows 8.1, but not Ubuntu

I've noticed when I visit dnsleaktest.com using Windows 8.1 & Chrome a bunch of UK IP addresses (Belonging to my ISP) are displayed alongside the Netherlands IP address I should be appearing as ...
1
vote
1answer
90 views

chrome app (javascript) - storing encryption password in memory

I'm building a chrome app that encrypts user messages on the client. The encryption is performed using the forge js library. I want to ask for the encryption password once, and use it to encrypt all ...
2
votes
0answers
41 views

Chrome: Watch for modified https-certificates

I read a lot about security of https and possible MITM attacks lately. For me it seems there is only possible way to make a https-MITM attack: When a MITM exchanges the shipped https-certificate and ...
2
votes
1answer
180 views

Single button click mobile direct carrier billing fraud

A friend of mine had just had the following happen: He visited a website with the mobile phone using Chrome Mobile on Android An advertisment poped up that covered the whole page There was no close ...
4
votes
1answer
176 views

OneDrive marked unsafe by Google Chrome due to unsafe scripts

The OneDrive user's drive page asks to load the following script (which is typically blocked by Chrome to be unsafe) <html> <head> <title>Bing</title> </head> ...
3
votes
3answers
104 views

Can Chrome sync be infected?

Can Chrome sync be infected by malware? I cannot imagine how, but a particular unproven example that comes in mind is to change the "preferences", so that a malicious proxy server is added. Another ...
6
votes
1answer
115 views

Third-Party-Cookies Tracking - Google Chrome

I've read an article about third-party-cookies which explained that in Google Chrome disabling third-party-cookies will not stop the browser from sending third-party-cookies. So when I visit Facebook ...
5
votes
1answer
938 views

How make Firefox ignore X-XSS-Protection header from server?

I have two questions: 1)How can I make Firefox ignore X-XSS-Protection header? I have a website which sends X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it destroys ...
3
votes
2answers
140 views

Is using Chrome and Tor Browser at the same time secure?

I question this recently because as I was using the Tor Browser, while in the same time my Google-Chrome was opened, and I right-clicked on a word to search it in 'Disconect', when the page loaded I ...
8
votes
3answers
667 views

Why do Firefox and Chrome “leak” critical security information out of the browser and how can I stop it?

In studying SSL / TLS handshakes and encryption, I found a method that describes how to export the SSL / TLS session keys from Firefox to an user or environmental variable outside the browser, and ...
2
votes
2answers
139 views

I delete cookies file in chrome but i'm still logged in after I restart Chrome

I'm using linux and google chrome as browser. I know that cookeis are stored at /home/my_name/.config/google-chrome/Default/Cookies. I deleted this file but it seems like when I restart Chrome and ...
1
vote
1answer
104 views

Do any browsers support Server Name Indication (SNI) but NOT SHA-2? [closed]

Yes, I know that SHA-2 signature validation is typically done by the operating system (with Mozilla Firefox/NSS and Chrome as of v39 being the exception).
2
votes
1answer
113 views

Chrome/FF not negotiating advanced ciphers?

Ran into a weird problem trying to lock down our AWS ELBs today, specifically trying to deprecate all support for SHA-1. Having removed options like AES256-SHA ECDHE-RSA-AES256-SHA (among others) ...
0
votes
0answers
22 views

Security implications of an “obsolete” cipher as indicated by Chrome [duplicate]

I guess this has been asked before, but what are the security implications of the below message? I've seen ciphers such as AES_128_GCM being labeled as "modern". Is this mitigated server side (load ...
2
votes
0answers
88 views

Why did Google sign every auxiliary app inside “Google Chrome.app” (OS X version) except for one?

$ codesign -dvv /Applications/Google\ Chrome.app/Contents/Versions\ /46.0.2490.80/Google\ Chrome\ Framework.framework/Resources/app_mode_loader.app/ /Applications/Google Chrome.app/Contents/Versions\ ...
1
vote
1answer
181 views

Security of cross-origin XMLHttpRequest Javascript

I am building a Chrome extension that will be making cross origin "get" and "post" requests to a few third party websites. I have been researching this process for hours and I am becoming increasingly ...
1
vote
1answer
213 views

How to prevent chromeipass from auto-filling credentials?

ChromeIPass (addon for Keepass on Chrome) wants to unlock the database every time it detects credential fields, even if I don't even have an account on that site. This is the default setting (october ...
1
vote
1answer
73 views

Protecting users with browser extension. Is it possible, if the machine is already infected?

Assume a trojan acquired admin privilege on a Windows 7 machine. How easy is it for the trojan to replace/hijack/modify a browser extension without user knowing it? Is it possible? I am thinking of ...
2
votes
3answers
164 views

Is it possible for a web page to log your keystrokes?

Is it possible to have a web page in Chrome open, and it can run a web app of sorts on the webpage, and have that web page log your keystrokes?
2
votes
0answers
105 views

HTML Injection on iOS?

I had an uncommon issue with both Safari and Chrome on an iPhone 6 running iOS 9.0.1 last night - a number of sites were displayed with altered links and/or additional links (clearly from a ...
3
votes
1answer
1k views

Why is secp521r1 no longer supported in Chrome, others?

Found a few issue threads, notably for Chrome (Chromium issue #478225), and the browser does appear to have dropped support for the secp521r1 curve (can test your browser using SSLLabs). There were ...
0
votes
1answer
201 views

Chrome + EMET= How Strong Realistic Protection Against Browser-Based Threats?

tl;dr: How secure is a combination of a sort-of hardened Google Chrome + Microsoft Enhanced Mitigation Experience Toolkit 5.1 against browser-based threats that I do not expect to be highly ...
0
votes
1answer
108 views

Possible sources of repeated Adware infections

In the last couple of months I have had the same thing happen on separate occasions to two Android phones, a Mac laptop and a Windows desktop computer. In all cases, something infects Chrome making ...
2
votes
1answer
275 views

Can SHA256 signature support be deduced from TLS cipher suites or any other part of ClientHello (if no signature_algorithm sent)?

Websites aiming to maintain maximum compatibility with (legacy) browsers may wish to serve SHA2-signed certificate chains to those user agents that support them, and SHA1 to those that don't. The TLS ...
1
vote
3answers
117 views

Addons in Chrome

When installing any add on in Chrome, a set of permissions is needed to be granted to the add on. Many addons(including popular ones like Pocket and Adblock) have Read and change all the data on the ...
1
vote
3answers
265 views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
3
votes
1answer
354 views

Should Flash be disabled, or are sandboxes secure enough?

Flash is a hot bed of vulnerabilities. Chrome contains a built in version of Flash, running in sandboxed mode. Obviously, this method is safer than running Flash as a plugin in either Firefox or IE. ...
3
votes
1answer
230 views

Getting a certificate warning for one email but not another

When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private". Here are the ...
1
vote
0answers
123 views

How to know which extension or software is causing ads in Chrome? [closed]

Starting yesterday, I noticed that something weird is going on with my laptop. After unlocking my laptop I found that the empty Chrome pages that I opened are getting redirected to ads. I am running ...
3
votes
1answer
214 views

Could the causes of CVE-2015-2502 vulnerability be common to Firefox and Chrome?

On Tuesday August 18, 2015, Microsoft published an advisory pointing out a 0-day vulnerability (CVE-2015-2502) that can be exploited by an attacker to perform a remote code execution on Internet ...
4
votes
1answer
137 views

Is Chrome for Android leaking my phone number?

I accidently clicked on an advertisement, and opened it with chrome. It was one of those things where you can subscribe to an App Store for £4.50 a week for apps which are usually free anyway. ...