0

Please consider this simple method which opens a new tab in JavaScript:

<!DOCTYPE html>
<html>
<body>

<p>Click the button to open a new browser window.</p>

<button onclick="myFunction()">Try it</button>

<script>
function myFunction() {
window.open("chrome://settings/");
}
</script>

</body>
</html>

This method works fine with URLs like https://www.google.com, but why can't I open the Chrome settings page?

3

Thats because the good folks at Google has decided that letting any webpage pop up the settings page would be dangerous. So they disabled it for the users security.

So what could a bad guy do with this? It could mainly be used to trick visitors of a site to change settings in a way that would benefit the attacker, e.g. reactivate insecure plugins or somehow lowering security levels. The non expert might not even understand that they are changing the browsers settings when they are on a page that popped up from some random website.

As a comparison, doing window.open("about:preferences"); from Firefox will just give you an error.

And really, what's the legitimate use case for doing this? I see no reasons for browsers to allow it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.