0

I was quite surprised to find out that both Chrome/Chromium and Firefox share cookies between different windows, even in their privacy-focused modes.

This seems a huge threat since it gives an attacker the chance to silently launch a new window and get access to all of the current cookies/sessions.

Is there a workaround to this, that restricts the current cookies/sessions to only the specific running window, to prevent such a scenario from being feasible?

5
  • 2
    What does the attacker control in this instance? Is there anything that a new window could do that can't be done with background AJAX requests already? Feb 23, 2022 at 15:50
  • The scenario that I have in mind involves someone who gained simple parallel access to the system. If they hadn't gone deeper and messed with the kernel and the window was restricted to itself, then it seems that the contents would stay there.
    – mangotango
    Feb 23, 2022 at 15:57
  • OP, do you feel that sharing cookies between multiple browser windows creates any attack vectors that are not already present, due to the fact that browsers share cookies between multiple tabs?
    – mti2935
    Feb 23, 2022 at 16:27
  • The difference that I see is that new window creation can be silent and completely unnoticeable. Tabs should be visible.
    – mangotango
    Feb 23, 2022 at 16:29
  • Firefox has a "Cookie sandbox" which limits tracking cookies to the current window/tab.
    – Robert
    Feb 23, 2022 at 16:45

1 Answer 1

2

... gives an attacker the chance to silently launch a new window and get access to all of the current cookies/sessions

A new window does not give the attacker any more access than it already has. If there is some XSS allowing access to cookies (not possible with httponly) then the attacker can use this XSS within the current window already. If there is some XSS which allows to just use the cookies to do actions in the name of the user then this can be done in the current window already.

Is there a workaround to this, that restricts the current cookies/sessions to only the specific running window, to prevent such a scenario from being feasible?

No. A new window is not any more special than a new tab.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .