Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Please consider this simple method which opens a new tab in JavaScript:
<!DOCTYPE html>
<html>
<body>
<p>Click the button to open a new browser window.</p>
<button onclick="myFunction()">Try it</button>
<script>
function myFunction() {
window.open("chrome://settings/");
}
</script>
</body>
</html>
This method works fine with URLs like https://www.google.com, but why can't I open the Chrome settings page?
Thats because the good folks at Google has decided that letting any webpage pop up the settings page would be dangerous. So they disabled it for the users security.
So what could a bad guy do with this? It could mainly be used to trick visitors of a site to change settings in a way that would benefit the attacker, e.g. reactivate insecure plugins or somehow lowering security levels. The non expert might not even understand that they are changing the browsers settings when they are on a page that popped up from some random website.
As a comparison, doing window.open("about:preferences"); from Firefox will just give you an error.
And really, what's the legitimate use case for doing this? I see no reasons for browsers to allow it.
