Is it safe to reuse a tab in a browser for different websites?

Question

A friend of mine recently asserted that it is unsafe to reuse the same tab in a browser for different websites. In other words, if the user:

1. Visits a sensitive website (for example logs in his bank account),

2. Goes to the address bar while the sensitive website is still opened,

3. Enters an URI of a different website which appears to be hacked,

then his bank account can be compromised. On the other hand, if the user:

1. Visits a sensitive website (for example logs in his bank account),

2. Closes the tab,

3. Opens a new tab,

4. Enters an URI of a different website which appears to be hacked,

then he's safer than in the first case.

The person asserting this couldn't explain concretely why is the second approach safer or show an example of such attack. He guesses that “is has something to do with memory management, in the second case, the memory being safely cleared”.

Without knowing the internals of browsers, this still seems weird to me. If there was a risk, I would expect it to be related to the browser's history (could the hacker's website benefit from accessing the history of my visit of the banking website?) and not memory management per se.

Is there an actual risk? Should I close tabs while going from a sensitive website to any other website?

Answer 1

I'm not aware of any security issue of reusing the same tab for different web sites, i.e. I don't think it is better or worse to reuse a tab vs. close and open a new tab.

But apart from reusing only a single tab it can be a security issue if you use the same browser application or the same browser profile or even the same operating system for sensitive and non-sensitive tasks. If the sensitive web site uses session cookies or similar mechanisms to keep you authorized and if this sensitive site is vulnerable to (very common) CSRF attacks then an attacker might misuse your identity from another tab or window within the same browser or even from a different browser on the same system. With simple session cookies it must be the same browser instance, but if persistent storage from flash or silverlight is used for identifying the user this identity token might be shared over multiple browser profiles or even between different browsers on the same system (see https://www.chromium.org/Home/chromium-security/client-identification-mechanisms for more details).

Thus for sensitive stuff like online banking you better take at least a different browser profile which gets only used for this purpose. Or you might even dedicate a different computer (or virtual machine) for this purpose.