Popular web browser by Google, see chrome.google.com for more information.

learn more… | top users | synonyms

1
vote
1answer
73 views

Protecting users with browser extension. Is it possible, if the machine is already infected?

Assume a trojan acquired admin privilege on a Windows 7 machine. How easy is it for the trojan to replace/hijack/modify a browser extension without user knowing it? Is it possible? I am thinking of ...
2
votes
3answers
168 views

Is it possible for a web page to log your keystrokes?

Is it possible to have a web page in Chrome open, and it can run a web app of sorts on the webpage, and have that web page log your keystrokes?
2
votes
0answers
111 views

HTML Injection on iOS?

I had an uncommon issue with both Safari and Chrome on an iPhone 6 running iOS 9.0.1 last night - a number of sites were displayed with altered links and/or additional links (clearly from a third-...
3
votes
1answer
1k views

Why is secp521r1 no longer supported in Chrome, others?

Found a few issue threads, notably for Chrome (Chromium issue #478225), and the browser does appear to have dropped support for the secp521r1 curve (can test your browser using SSLLabs). There were ...
0
votes
1answer
237 views

Chrome + EMET= How Strong Realistic Protection Against Browser-Based Threats?

tl;dr: How secure is a combination of a sort-of hardened Google Chrome + Microsoft Enhanced Mitigation Experience Toolkit 5.1 against browser-based threats that I do not expect to be highly ...
0
votes
1answer
126 views

Possible sources of repeated Adware infections

In the last couple of months I have had the same thing happen on separate occasions to two Android phones, a Mac laptop and a Windows desktop computer. In all cases, something infects Chrome making ...
2
votes
1answer
321 views

Can SHA256 signature support be deduced from TLS cipher suites or any other part of ClientHello (if no signature_algorithm sent)?

Websites aiming to maintain maximum compatibility with (legacy) browsers may wish to serve SHA2-signed certificate chains to those user agents that support them, and SHA1 to those that don't. The TLS ...
1
vote
3answers
124 views

Addons in Chrome

When installing any add on in Chrome, a set of permissions is needed to be granted to the add on. Many addons(including popular ones like Pocket and Adblock) have Read and change all the data on the ...
1
vote
3answers
285 views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
3
votes
1answer
443 views

Should Flash be disabled, or are sandboxes secure enough?

Flash is a hot bed of vulnerabilities. Chrome contains a built in version of Flash, running in sandboxed mode. Obviously, this method is safer than running Flash as a plugin in either Firefox or IE. ...
3
votes
1answer
239 views

Getting a certificate warning for one email but not another

When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private". Here are the ...
1
vote
0answers
127 views

How to know which extension or software is causing ads in Chrome? [closed]

Starting yesterday, I noticed that something weird is going on with my laptop. After unlocking my laptop I found that the empty Chrome pages that I opened are getting redirected to ads. I am running ...
3
votes
1answer
220 views

Could the causes of CVE-2015-2502 vulnerability be common to Firefox and Chrome?

On Tuesday August 18, 2015, Microsoft published an advisory pointing out a 0-day vulnerability (CVE-2015-2502) that can be exploited by an attacker to perform a remote code execution on Internet ...
4
votes
1answer
167 views

Is Chrome for Android leaking my phone number?

I accidently clicked on an advertisement, and opened it with chrome. It was one of those things where you can subscribe to an App Store for £4.50 a week for apps which are usually free anyway. ...
1
vote
1answer
3k views

Difference between X-Forwarded-For IP, X-Real-IP, VPNs and TOR

I have this Google Chrome Privacy Preserving Extension that I am working on. Where I can spoof the header information e.g user agents and else. When I spoof X-Forwarded-For IP and go to http://...
5
votes
2answers
221 views

Are X.509 nameConstraints on certificates supported on OS X?

I have the following "chain" of certificates on a test machine right now: A self-signed CA cert, in my Keychain and trusted & trusted by Firefox. A CA cert with with the following, X509v3 Name ...
1
vote
2answers
233 views

Should I update my SHA-1 certificates? If so, how?

Q: Should I update my SHA-1 certificates? If so, how? Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
4
votes
1answer
314 views

Can't get rid of “Your connection to website is encrypted with obsolete cryptography”

In my Nginx config I have: ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:...
0
votes
1answer
88 views

Should a Web Search with Evernote results be a concern?

While using a Chromium based browser (Chromodo) and doing a regular Google search, Evernote is now appearing on the side with "related results in your notes". Does anyone know how they are doing it?...
5
votes
3answers
215 views

Is my Google session safe when my computer is logged out or locked?

I've recently uploaded all the family photos to my Google Drive account. I have a strong password and 2 step verification enabled on my Google account. My home computer is (naturally) trusted and ...
6
votes
3answers
734 views

Ali Express hijacking my Chrome

So randomly every now and then, when I click on a link - instead of opening it normaly, a new tab is opened and some website with "tracking" in the name (I haven't caught the full name yet, it's quite ...
3
votes
1answer
4k views

Chrome showing SSL warning about SHA-1 when the sites don't use SHA-1

My version of Chrome on an iMac (latest 43.0.2357.130 (64-bit)) is showing an SSL warning for well-known sites (Hackernews, GitHub, DigitalOcean): This site uses a weak security configuration (SHA-...
2
votes
2answers
722 views

Using VPN in the UAE - safe or trackable?

I'm currently in the United Arab Emirates, and I am wondering if Etisalat or the UAE can track what I am doing if I use the ZenMate VPN addon to Chrome?
4
votes
1answer
129 views

What technologies does ChromeOS use to secure saved passwords?

I have read that Chrome will use the system's native credential tools to manage saved passwords (e.g. KeyChain on OSX, libsecret on Linux/GNOME etc). Does anyone know what tools are used on ChromeOS?
0
votes
2answers
631 views

Authenticating Hotmail's certificate and connection security

I've recently received the following error message from hotmail.com (or live.com) after I have logged in using Chrome browser, consistent using different accounts and computers (regardless of 2FA or ...
3
votes
1answer
642 views

are chrome extensions in the Chrome store generally safe?

Should I ever be worried about installing any chrome extension from the Chrome store? A lot of the Chrome extensions I have, have the permission "Read and change all your data on the websites you ...
7
votes
2answers
6k views

Obsolete cryptography (SHA1) warning although certificate uses SHA256

I ordered a certificate with SHA256 from Comodo and was wondering why Chrome shows this message: Your connection is encrypted with obsolete cryptography. The connection is encrypted using ...
0
votes
1answer
431 views

Google Chrome obsolete cryptography

I have a apache server running and following configuration for ssl: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" SSLProtocol -all +TLSv1.2 SSLCompression Off ...
17
votes
2answers
7k views

Securing Google Chrome Browser against the Logjam exploit on Windows

Is there a way to fix Chrome against the Logjam TLS exploit on Windows? I have updated my Chrome to the latest version yet the https://weakdh.org/ website warns me that "web browser is vulnerable to ...
1
vote
1answer
102 views

Give Someone Access to Secure Website? [closed]

I have someone I hired on a Freelancing website working for me - so far he has worked for me for about two weeks and is doing a good job. In order for him to complete his work he will need access to ...
4
votes
1answer
365 views

Different SSL cert behavior with Chrome on desktop vs. Chrome on iOS

We have a website, https://uk.care.com, that has a GeoTrust multi-SAN cert on it. The cert is up-to-date, using SHA-256, TLS 1.2, etc. When we view the site in Chrome on various desktop systems it ...
0
votes
7answers
5k views

Malware ad.adsmatte infection

My PC is infected with malware, whenever I open a webpage and click on it a new tab opens on "ad.adsmatte.com". I scanned my PC with Malwarebytes but was unable to resolve the problem. So I ...
0
votes
0answers
2k views

Does this list every Chrome extension/addin that may leak privacy?

I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party. To that end, I discovered: chrome://net-...
6
votes
1answer
311 views

How do I securely embed an <img> tag using a user-given URL?

If I hypothetically wanted to allow users to use an avatar from an arbitrary URL like this: <img class="avatar" src="{user input}" /> There are many problems that I can think of: There are ...
0
votes
1answer
388 views

Why does Chrome display "Your connection to website… However, this page includes other resources which are not secure…”? [duplicate]

I know there is a similar post, but I thought this one is different because I do not get this consistently, the message and icon are different. Please compare the message with that of the so-called "...
6
votes
3answers
708 views

Favicon Redirection Possible Security Flaw

I have the domain example.com When I enter the URL https://api.example.com, Chrome loads the page and also tries to load https://myapp.example.com/favicon.ico, and that request receives a 301 ...
0
votes
2answers
802 views

Disabling CBC ciphers does not stop Chrome from negotiating to use CBC ciphers

I am getting an message about 'obsolete cryptography' from Chrome. Your connection to (site) is encrypted with obsolete cryptography. The connection is encrypted using AES_256_CBC... Per ...
3
votes
0answers
260 views

Problem in underscore.js with “new Function()” when CSP header is set

In underscore.js, template rendering causes violation of the 'unsafe-eval' property, with CSP error at following line: render = new Function(settings.variable || 'obj', '_', source); The solution ...
9
votes
1answer
1k views

Distinguish between Wi-Fi Captive portal and MitM attack

Not sure whether this should be asked in Super User or here. How does Chrome distinguish between a Wi-Fi access point intercepting with a captive portal and a man-in-the-middle attack on HTTPS? Are ...
0
votes
1answer
67 views

MitM Chrome Mobile

I just came across the issue about MitM on Opera/Nokia browser 2013. I know, this is an "old" problem, but it seems very interesting to me. I was wondering how Chrome on mobile handles the SSL ...
6
votes
3answers
74k views

HTTPS icon red and crossed out - Chrome browser

What does it actually mean when the HTTPS icon is red and crossed out in Chrome? Does this mean that the site is vulnerable to a Man in the Middle Attack? Is it safe or not?
8
votes
1answer
2k views

TLS 39 month certificate limit and Chrome's NET::ERR_CERT_VALIDITY_TOO_LONG error

Late last year the CA/Browser Forum decided to limit the maximum valid term of TLS/SSL certificates issued after 1 April 2015. After this time, as the official guidelines put it.. CAs SHALL NOT ...
1
vote
1answer
664 views

Is using Chromecast “a security nightmare”?

I'd like to use Chromecast on our office network. Doing so requires enabling UPnP (Universal Plug and Play). A quick search turns up statements like this: The US Department of Homeland Security ...
4
votes
3answers
16k views

Chrome showing cryptography as 'obsolete' [duplicate]

Similar to this question, Chrome is showing the connection cryptography as obsolete. Opera, IE and Firefox seem perfectly fine with the connection. My guess would be the message authentication is ...
4
votes
2answers
45k views

What is s3.amazonaws.com, and why is Chrome blocking it?

Lately, whenever I click on a download link in Google Chrome, it redirects to another link starting with s3.amazonaws.com, which in turn gets blocked either by Chrome or by my Antivirus (Comodo ...
3
votes
1answer
5k views

Cannot turn off XSS filter in Chrome

I am using the following command to launch Chrome: "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --args --disable-web-security to turn off XSS auditor in chrome in Windows 7, but ...
0
votes
1answer
198 views

Audio not playing on Android (Kitkat 4.4.2 on LG G Pro 2 D838) via HTTPS [closed]

I am having issues playing an audio file on the chrome browser! This audio file plays on the chrome browser on my mobile LG G Pro-2(D838) running Kitkat 4.4.2 without any issues. But when i uploaded ...
2
votes
2answers
464 views

Might Google log every website I visit using Chrome?

I wanted to start using Chrome for quite some time now, but I really don't want to tell Google about whatever sites I visit. So I was wondering if Chrome sends any data to Google telling them what I'...
2
votes
2answers
125 views

Browser Updated, yet still vulnerable to POODLE

So here's a situation, some of my company's partners notified us that they will be entirely disable their server's SSLv3 support. This prompts my superior to take this chance to update our operation ...
52
votes
4answers
106k views

Google Chrome “Your connection to website is encrypted with obsolete cryptography”

Google Chrome is showing new information in the certificate section. Is this a big deal? If so how can I fix it on the server end? EDIT: Thanks for the answers but I'm not skilled in cryptography ...