Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them:

Use a prediction service to load pages more quickly: Browsers use an IP address to load a webpage. When you visit a webpage, Chrome can look up the IP addresses of all the page's links and load the ones you might navigate to next. If you turn this setting on, websites and any embedded content that are pre-loaded may set and read their own cookies as if you had visited them, even if you don't.

The option is in advanced > privacy > Use a prediction service to load pages more quickly

How vulnerable is it to attacks? Let's say someone sends me a link using Facebook Messenger or Twitter, or on other websites. If this setting is on (which is on by default!) then will Chrome open that link?

Will my IP address get leaked because of this? Maybe opening up my browser to even worse attacks and identity leaks?

I just don't understand how can this not be a major security flaw, am I missing something? Is there any protection against these type of attacks in this service if I leave it on?

  • There's a difference between "loading" a page and "opening" it
    – schroeder
    Nov 1 '18 at 17:03
  • The autocomplete prediction service has been known to open the user up to potential credential leakage. check out: no-sec.net/… . If an attacker can set up a box on the network that responds to certain network requests that chrome sends out it can send poisoned responses. Also check out the tool mentioned in that post: github.com/SpiderLabs/Responder
    – DarkMatter
    Nov 1 '18 at 17:07
  • @DarkMatter But that's the Windows network credential (requiring a DC), not the credential of the target site, and is a local threat based on DNS lookups. That's a lot of conditions to be successful. And perhaps it is a problem exacerbated by Chrome, but perhaps more of a Windows DNS issue? And that weakness is not from the pre-fetch but from the auto-complete
    – schroeder
    Nov 1 '18 at 17:13
  • @schroeder I agree and there are definitely similar issues with Windows DNS that allows for malicious poisoning. This type of spoofing/poisoning is a real issue and chrome is guilty of contributing to the security problem in the name of efficiency. "Luckily" this is mainly only an issue in an enterprise context where hopefully if you are using chrome it has been configured by IT to remove some of these features.
    – DarkMatter
    Nov 1 '18 at 17:20
  • @DarkMatter so overall how likely is it for chrome to open that malicious link? for example if someone send me a message containing that link in twitter. Nov 1 '18 at 17:41

It does not make sense, in terms of providing faster service, for Chrome to pre-fetch all those pages and process all of them before you visit them.

What happens is that the code is fetched and loaded, but not processed. When you click on a link, then the code is processed. This makes the process faster.

So, if there is malicious code on one of those links, it might get pre-fetched but it will not get executed until you click the link.

  • BUT in that case my IP address would be leaked right? because i visited that website to fetch and load the page, correct? isn't this a huge security flaw? Nov 1 '18 at 17:20
  • How is IP "leak" a security flaw?
    – schroeder
    Nov 1 '18 at 17:21
  • So my IP address getting leaked to random people without me even opening a link is not a security flaw?! Nov 1 '18 at 17:22
  • Nope. Unless you have a specific concern?
    – schroeder
    Nov 1 '18 at 17:23
  • 1
    You are combing several different concepts that should be separate. IPs can be a privacy concern. Privacy and Security are related but very different concepts. That's why the setting is in the privacy section. The victim's router and IP are already very public and searchable. There is no need to collect the IPs through these types of methods.
    – schroeder
    Nov 1 '18 at 17:29

There is no code execution vulnerability. Put simply, the bottleneck for any well designed site is the network, so prefetching the data for links reduces the impact that network performance has on actually accessing those links. In essence, what these services do is preload the data into the browser's cache so that you don't have to download it over the network when you follow the link. This is fundamentally no different from manually downloading a copy of a web page using a tool like cURL or wget, no rendering work is being done, and no javascript is being processed.

There are, however, a couple of other risks with this:

  • From an outside perspective, without proper correlation, this looks like you're actually following all those links.
  • Your external IP address gets leaked to any systems you happen to connect to.
  • Your bandwidth utilization will look different from how it otherwise would.

The first is not likely to be a serious issue unless you are living under a totalitarian regime or frequent shady (but not necessarily illegal) sites. The second is not likely to be an issue (if you are using IPv4, you're almost certainly behind at least one NAT router anyway, and even if you aren't or are using IPv6, there is almost certainly still a firewall between you and the internet). The third is not likely to be an issue at all, but may affect how your ISP handles your connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.