1

Please consider this simple method which opens a new tab in JavaScript:

<!DOCTYPE html>
<html>
<body>

<p>Click the button to open a new browser window.</p>

<button onclick="myFunction()">Try it</button>

<script>
function myFunction() {
window.open("chrome://settings/");
}
</script>

</body>
</html>

This method works fine with URLs like https://www.google.com, but why can't I open the Chrome settings page?

1 Answer 1

4

Thats because the good folks at Google has decided that letting any webpage pop up the settings page would be dangerous. So they disabled it for the users security.

So what could a bad guy do with this? It could mainly be used to trick visitors of a site to change settings in a way that would benefit the attacker, e.g. reactivate insecure plugins or somehow lowering security levels. The non expert might not even understand that they are changing the browsers settings when they are on a page that popped up from some random website.

As a comparison, doing window.open("about:preferences"); from Firefox will just give you an error.

And really, what's the legitimate use case for doing this? I see no reasons for browsers to allow it.

1
  • one great use-case for this would be to link the user to their language preferences so that they can more easily change from en-US to en-CA (for example). Why would that matter? So that we can display imperial vs. metric units more correctly without having to write a user-preferences backend... and allow them to more easily change to a country other than US if they like metric better. Would be amazing to be able to link to chrome://settings/languages for this purpose (if they are on chrome, that is). Commented Mar 19, 2022 at 21:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .