Hot answers tagged chrome
22
There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a login popup for anyone visiting a page where your avatar appears. Lots of people will then attempt to log in with some username and password combination, probably ...
10
There are two vulnerabilities, each triggering a jump to address zero:
The first, inside markContainingBlocksForLayout:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb09fdb70 (LWP 2039)]
> 0x00000000 in ?? ()
(gdb) bt
> #0 0x00000000 in ?? ()
#1 0x0194b82b in markContainingBlocksForLayout (this=0x2e29944, ...
8
Open source software is not necessarily better or more secure.
Where open source has an advantage is the potential for independant security minded individuals to examine the source code and hopefully the conceptual model for a given software project. This advantage is contingent on:
review by qualified individuals
feedback from the reviewer to the ...
7
As other answers have already covered, Blue coat (amonngst other security products) have the capability to intercept SSL sessions for users on the network, to inspect the traffic.
What your company can and cannot do with this information depends on local laws and potentially the contract you signed when you joined the company.
If you have sufficient ...
6
I'm pretty sure this is fairly benign. You can use the PSAPI functions to get the same details if you have sufficient privileges. I'm pretty sure this is the basis for the Task Manager built into Windows as well as the Process Explorer. Note that on Linux machines, you can generally see these details as well regardless of your permission set.
Chrome is ...
6
I install a plugin that allows me to click on any part of a page and it gives me the color of the clicked object
For this to work, the plugin needs to register a click event handler and it needs to interact with the document object model of the current HTML page.
HTML was originally designed to share scientific documents. And while we build complex web ...
6
Yes
Yes
Yes
Updated, See the comment from George Bailey for this one.
No - like you say the sandbox will prevent that.
Read (and send) data on all the pages you visit.
Some more details on why this is often needed, but not always is discussed in this question Why need Chrome plugins access to 'all my data' and 'browsing activity'?
6
Safe Browsing API
Google offers Safe Browsing, which uses URL lists as well as heuristics:
Safe Browsing works in two ways to help protect you against phishing and malware. First, Google downloads a list of information to your browser about sites that may contain malicious software or engage in phishing. If the URL of the site you're on matches ...
6
BEAST attack Vulnerable INSECURE (more info)
RC4 Yes PROBLEMATIC (more info)
These warnings are not directly related to your certificate. They're more about your SSL configuration. When a client connects to your server over SSL, the client and server will negotiate which protocols they want to use to exchange keys and encrypt data.
BEAST is a ...
5
Sounds like its an google's echo test for chrome. The whois (below) points back to Google, Inc. It seems that it is used to send back network connectivity stats to a google server for ~0.5% of users..
An echo in this context just means whether if you send a simple message to a remote computer if you hear back. (Similar to ping/ICMP message).
EDIT: See ...
5
Google Chrome browser uses preloaded HSTS list. Firefox 17 (most recent release) also added support for the list. It is the same list that Google Chrome uses. HSTS, along with having HTTPS only website are best mitigations against such an attack. Your HTTP website should only permanently redirect to HTTPS and not provide any content.
5
The IMG tag will attempt to interpret the data as an image, so Javascript won't be executed.
It will be possible to send an image that, once decoded, will require enormous amounts of memory ("PNG bomb"), and it is possible that the graphic routines themselves are vulnerable to malicious content (a carefully crafted image that, when decoded, triggers ...
4
Google Chrome has been "hacked", here is a POC of an exploit that manage to pass the sandbox-
VUPEN_Pwning_Chrome
btw - the exploit is private, and as far as we know the lastest version of chrome is still vulnerable to this code execution method.
4
The basic problem is that the plugin model doesn't have a properly defined/granular authorization policy. In a lot of cases its all or nothing when it comes to certain pieces of information.
Maybe the plugin needs to know the particular URL of the page you are on. Well that might require access to browsing history, etc. The other part of the problem is ...
4
I like @this.josh's answer where he says Open Source is not automatically better or more secure. It's the development process and the QA that matters most, the rest is a matter of personal preference.
Here are a few thoughts that come to mind when I consider using IE that was created with a proprietary development process
One year after IE6 browser was ...
4
I think the confusion here lies in that 1e100.net appears to be owned by MarkMonitor. Actually, MarkMonitor have registered (and "protect") this domain for Google.
You can see here that Google own 1e100.net: What is 1e100.net?
So Google Chrome is phoning home but to Google's servers.
4
Maybe it's best to explain the problem with mixed content.
A lot of websites will store the login state into the session, and if an attacker has the session-id, he can impersonate the logged in user. The session-id must be sent along with each request, so the server can recognize the user, this will usually be done with a cookie containing the session-id.
...
4
Yes, it does add to security and yes it should be done but security is often neglected over usability.
For example the Chrome notification is barely even present as opposed to the firefox popup. More importantly, to actually prevent such a threat the browser must not only notify the average user (who would have no idea what's doing on) but also give the ...
4
There is nothing there that is a security reporting issue - Chrome isn't sending anything back to HQ here, it is simply reporting the memory info you can get yourself.
As Greg says, it is a marketing gimmick - Google have it in there so you can perform a like for like comparison (presumably to show you that Chrome is better at memory usage than competitors)
...
4
This is Google SafeBrowsing. Google keeps a blacklist database of what sites are known or suspected of hosting malware and provides APIs for browsers to check the list.
Safe Browsing is a service provided by Google that enables applications to check URLs against Google's constantly updated lists of suspected phishing and malware pages.
4
Yes, you are safe.
Of course, the page you get served when you Right click > View Image could be malicious, but no script will be executed in the context of your website.
Moreover, don't forget that the owner of the website of the image can track your visitors on all pages where the image is embedded.
4
By executable, you probably mean the .exe "executable" format that Windows uses to denote anything that contains a program. (Note that other extensions such as .com may also be executable, and it are not only executables that can get you infected; a malicious PDF does the job just as well.)
Any OS allows the execution of files, or else you can't do things ...
4
You can see the same effect on https://www.comodo.com/
They have an EV certificate signed by themselves. Firefox trusts it:
but Chrome doesn't.
Chrome works fine with Verisign:
The problem here is likely that your browser doesn't trust your SSL certificate vendor. It's possible that you have messed up the configuration somewhere (chain ...
3
Carpet bombing is a military term - meant to indicate laying a carpet of explosives or incendiaries in order to kill/destroy anything within the target area.
Wikipedia says:
Carpet bombing is a large aerial bombing done in a progressive manner
to inflict damage in every part of a selected area of land.
The phrase evokes the image of explosions ...
3
No. Sandboxes aren't overrated. They've very useful. They are not a silver bullet -- they don't solve every security problem -- but they do have substantial value.
Really, don't think this is especially new. If you read the original paper describing the Chrome security architecture, it clearly explains why sandboxing is valuable while also elucidating ...
3
I was also wondering why chrome ask every time a new application-specific password. Then I realized the reason is that the computer which chrome run on is not a trusted computer. I made it a trusted computer then chrome never asked specific password again.
Here is how to make a computer trusted, quoted from here
You can add your computer to the
...
3
First of all I would pay attention to Permission Warnings.
Performing an analysis of an extension is a game of cat and mouse. You can sniff the network traffic and the attacker can use Stenography. You could unpack the extension and look at the JavaScript code, but the malicious code could be obfuscated or underhanded.
That being said. Chrome runs ...
3
https://bugs.webkit.org/buglist.cgi?keywords=XSSAuditor&resolution=--- Are for sure ways for bypassing the filter. (Taken from the blog site).
There are always ways to obfuscate code - Check out https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet for a long list of evasion possibilities.
3
It's common practice to do this and they are indeed doing a kind of man in the middle. Blue Coat works as a proxy, but also inspects the websites you are looking at (refer to https://kb.bluecoat.com/index?page=content&id=FAQ463). Considering you are working on their network, they have the right to do this. Do note that Blue Coat is a tool often used to:
...
Only top voted, non community-wiki answers of a minimum length are eligible
