Popular web browser by Google, see chrome.google.com for more information.

learn more… | top users | synonyms

3
votes
2answers
49 views

How are CRLsets more secure?

Google Chrome doesn't do typical CRL/OSCP checks, instead it depends on CRLsets. In simple terms, Google scoops up the CRLs from most CAs, trims them down and delivers the CRLset to the browser via ...
1
vote
0answers
45 views

Is Google Chrome Extension access to SSL certificate validation output possible?

I want to develop an extension which will stop an user from proceeding to any banking site (configurable by user) if a proxy like paros is seating in between sending fake certificate to user. My ...
1
vote
2answers
291 views

Self-signed SSL certificate on chromebook (and android)

I am having the following problem on both my android phone and on my chromebook. I'm running a website on an internal server (10.3.3.3) using nginx with a self-signed ssl certificate. Since it is just ...
3
votes
2answers
202 views

How is HTTPS Everywhere leaking my Twitter session from an incognito window?

I manage a couple of twitter accounts for businesses/websites that are separate from my personal account. For simplicity, I prefer to log in from an incognito window so that I don't need to log out of ...
4
votes
4answers
341 views

Is chrome completely secure against Reflected XSS?

I notice that Chrome does not execute scrips that are part of the web request, http://vulnerable_site?pageTitle=<script>alert('xss')</script> With such links since the script is as part ...
-1
votes
0answers
14 views

Separate Work and Personal Profiles on Chrome [migrated]

I have been using multiple profiles on Chrome for both Work and Personal. In preparing to exit Work, I noticed that the majority of my personal Saved Passwords are available in my Work profile (and ...
15
votes
3answers
632 views

Are official browser add-ons really safe?

Almost any browser addon/extension that I install on my Chrome or Firefox (be it Firebug, RESTClient, ...) warns me, saying: It [the add-on] can: Access your data on all website Access ...
1
vote
1answer
114 views

How can this be possible? (malware autoinstall on chrome)

I have a website, using an ads service (qadabra). Yesterday some users reported me that the ads service sometimes redirects to a site containing malware. the url is this: PLEASE DON'T OPEN IT, IT ...
4
votes
4answers
232 views

What Trusted Root Certification Authorities should I trust? [duplicate]

After two recent Slashdot articles (#1 #2) about questionable Root Certificates installed on machines, I decided to take a closer look at what I have installed on my machines. (I use current versions ...
0
votes
1answer
126 views

Chrome extension sends browsing information [closed]

When visiting a url in Chrome, I saw in Fiddler, after the responses, calls to: http://api29.datarating.com/related http://api29.datarating.com/service2 For example after going to ...
24
votes
2answers
2k views

What exactly does it mean when Chrome reports a certificate 'does not have public audit records'?

When visiting Gmail in Chrome, if I click on the lock icon in the address bar and go to the connection tab, I received a message 'The identity of this website has been verified by Google Internet ...
2
votes
0answers
37 views

Are files created in Chrome OS developer mode tracked by Google?

If I enable developer mode, then open a shell and create /some/directory/temp.txt, it is invisible to me through the Chrome Filesystem API. But does this mean that it's also invisible to Chrome OS ...
140
votes
2answers
13k views

Don't understand how my mum's Gmail account was hacked

My mum (on Gmail, using Chrome) received an email from a friend's Hotmail address. She opened the email (very obviously a phishing email) and clicked a link in it. This opened a webpage with loads of ...
1
vote
2answers
89 views

Do Chrome/browser extensions break the tab sandbox?

So, as far as I know, Chrome and possibly other browsers have a very low privilege process spawned for every tab. How do browser extensions interact in regard to this sandboxing? I'm not talking ...
1
vote
2answers
161 views

Extracting Facebook ID or E-Mail from Browser History

While i was looking at my browser history i noticed there has been a facebook login from my computer, there are some facebook related messaging and profile links in my browser history (chrome). The ...
2
votes
1answer
78 views

Does using Chrome bypass the Apple iOS gotofail bug ?

Does the recent certificate gotofail bug affect me if I'm running version 6 of iOS, but only use Chrome as my browser?
3
votes
1answer
47 views

Google Chrome Apps phishing

What prevents an attacker from copying and pasting a Chrome packaged app (which is just a zipped web app) then distributing it on the Chrome webstore under a slightly different name?
1
vote
2answers
220 views

Why is my browsing history visible outside my network?

Whatever I and my family members do at 'Home PC' is visible in the history in Google chrome in my 'Office PC'. The two networks are entirely different! I saw all websites visited on our home PC by my ...
1
vote
2answers
142 views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
1
vote
2answers
435 views

Website login protection with chrome extension

Right so I'm developing very private systems recently, and I'm looking into admin login protection. I'm a PHP dev with essential knowledge of js/jq. While I handled most of the stuff so far, I'm ...
1
vote
3answers
85 views

What additional mitigations are necessary due to “Continue where I left off”?

I work with sensitive sites that handle financial information, my code protects more than four billion pounds of assets. All of our sites have a logout button and in addition use HttpOnly, Secure, ...
0
votes
0answers
19 views

Is the new modern ui chrome more secure? [duplicate]

Chrome 32 was launched with a modern ui app (a.k.a metro app) for Windows 8. When you launch it in this mode, a Google-OS-like desktop is shown, in fullscreen, there you can open all your chrome ...
2
votes
1answer
62 views

Chrome inline JavaScript string interpreatation

If you have an HTML file that contains the following code : <!doctype html> <html lang="en"> <head> <meta charset="UTF-8"> </head> ...
1
vote
2answers
2k views

Why does chrome connects to MarkMonitor (always on startup)

While using internet (over Chrome), I noticed that lsof -i returned certain suspicious URL(s). A whois lookup suggested that all of those belonged to MarkMonitor. For example: chrome 3224 ...
1
vote
1answer
1k views

Efficacy of Chrome incognito mode

I am curious about the true efficacy of the browser private mode. I did a bit of googling and stumbled upon the following page. ...
11
votes
4answers
7k views

Remove RC4 from SSL/TLS ciphers in Chromium

Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
1
vote
1answer
541 views

Is Vimium (Chrome extension) really safe?

I really like the Chrome extension Vimium. It significantly speeds up surfing for power users. However, when you install it, Chrome warns you because this extension injects JS code on every page you ...
0
votes
0answers
21 views

Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery [duplicate]

Can you tell me shortly how to fix this problem in Chrome? Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery
4
votes
2answers
1k views

Password management in Firefox, Chrome and Safari

I just read a couple of very interesting discussions on Chrome password security strategy. Chrome’s insane password security strategy Showing stored passwords - Tim Berners-Lee The following is how ...
4
votes
1answer
2k views

Vulnerability of Chrome's “Login Data” file after being orphaned from the host system

Suppose someone were to knick a "Login Data" file from a Windows computer's Google Chrome profile. They don't know the machine's user account password, but they may have some ideas as to what it ...
6
votes
1answer
5k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain malware attacks. NoScript is well known as it's a very powerful extension for Firefox and introduced protection from ...
2
votes
1answer
297 views

Different SSL states as seen by Safari, Chrome and Firefox

Today, I visited some sites of the German DHL group. While Chrome and Safari complain about an invalid certificate of Firefox accepts it. Which one is right, which one is wrong? Which decision ...
0
votes
1answer
366 views

Google Chrome - save usernames NOT passwords [closed]

I've scoured the settings page and googled this to no avail. I want Chrome to stop saving my passwords BUT keep saving usernames/email. Is that possible? All I seem to be able to do is disable ...
-3
votes
1answer
1k views

Google Chrome is keylogger? [closed]

Hi i am a little bit worried that Google Chrome is logging my keystroke. One time ago i had situation with chrome that when i clicked some where in input box he was writting key by key(even backspace) ...
22
votes
5answers
2k views

IMG tag vulnerability

Is it safe to display images from arbitrary domains? I.e. let's say I have an image on my page: <img src="http://badguy.com/image.gif" /> What if image.gif will return some js attack vector, ...
3
votes
3answers
238 views

Why Parallels 8 installer looking into my Chrome's Cookies?

While trying to install Parallels on OS X I looked into Activity Monitor to find where is the installed Parallels located (it was weird that it stays invisible in Application folder). And than I found ...
6
votes
1answer
289 views

Comparison between Firefox password manager and chrome password manager

As a follow up to Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?, I would like to know how firefox's password manager compares, if you have a master password and ...
2
votes
2answers
1k views

What causes “High Risk Website Blocked” on Chrome?

I have a website with no ads and no external content. Everything on the page comes from the webserver in question. Some users on Google Chrome have reported that they see the following warning when ...
2
votes
1answer
162 views

Chrome torn down the TLS connection after received server ChangeCipherSpec

I met a strange issue that the TLS connection is always torn down by Chrome after received server ChangeCipherSpec. The sequence is as following: Client Server SYN--> ...
1
vote
2answers
2k views

Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images ...
7
votes
2answers
143 views

What security measures does Chrome have in place to sandbox different user accounts?

Google Chrome has a feature that allows different users to use Chrome on the same computer in a completely separate space. The support page is quite light on information. Is there information ...
3
votes
2answers
245 views

Injecting information in a web page (Gmail). Does it raise security problem?

I am developing a Google Chrome extension which encrypts/decrypts emails for Gmail users. So, I detect encrypted emails when the user opens an email on using tags. Once an encrypted email has been ...
0
votes
2answers
164 views

Securing a web service consumed by chrome extension

I'm trying to think of a good security method to secure a web service consumed by a google extension. As known, google chrome extension's source code is open to anyone. My extension mainly deals with ...
12
votes
2answers
999 views

Why do Chrome extensions need access to 'all my data' and 'browsing activity'?

Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install an extension that allows me to click on any ...
10
votes
2answers
390 views

Any tool for scanning vulnerabilities in browser extensions?

I am scanning browser extensions of Chrome and Firefox for vulnerabilities. Is there any tool which would help me do this?
6
votes
1answer
357 views

How do I check the code of a Chrome extension to make sure it's not stealing my info?

I've been reading more and more about just how much access browser extensions can have to your data. This is a little unsettling, so I'm curious if there is a way to Vet these extensions and make sure ...
1
vote
2answers
741 views

Are Google Chrome Extensions vulnerable?

I've just discovered this: You can create IFRAME pointing to "chrome-extension://" protocol You can access IFRAME content with jQuery Does this mean, I'm able to use badly written Chrome ...
5
votes
1answer
195 views

Google Chrome & Spear-phishing

I've been trying to find some information on how Google Chrome detects phishing pages that are not already in their blacklists. The most relevant information that I've found from Google itself, ...
8
votes
2answers
6k views

Is there any way to get Chrome 27 to trust a self-signed cert? [closed]

I'm running latest gen Chrome (27) and preparing a demo that requires using a self-signed cert to support HTTPS on a local IIS website. The cert has been created with the correct common name for the ...
2
votes
1answer
314 views

How Browsers prevents Malware and Phishing attacks

I want to know how phishing and malware protection features are implemented in modern browsers like Chrome, Firefox, IE etc. Are these features heuristic based, or do browsers maintain a list of ...