Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

0
votes
0answers
34 views

Saved browser login information disappearing [duplicate]

I recently noticed that my browser (Chrome) is not saving my login state for websites anymore. The first time it happened I didn't thought much of it but it happened again and again. I also noticed ...
0
votes
1answer
59 views

Is it possible to browse HSTS sites over SOCKS5 proxy?

I am unable to browse HSTS websites using SOCKS5 proxy in chrome browser...getting this error... This site can’t be reached The web page at https://www.instagram.com/accounts/login/?hl=en might ...
0
votes
1answer
51 views

Installed sketchy Chrome extension - Potential malware infection?

So... Tired me was browsing through Ikea's website this morning and tried to use one of their visualisation tool. Got an error message saying that I was not running the lastest version of Adobe Flash. ...
2
votes
1answer
95 views

Why would Chrome return non-deterministic bytes for a versioned release?

From the: Abusing SHA-1 collisions for Chromium updates https://news.ycombinator.com/item?id=20114809 https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/networking/browsers/chromium/...
-2
votes
1answer
90 views

is it possible that an attacker catch a page name from history?

like if an attacker sets a dns rebinding would he be able to get the router name from the history so he can make his attack more accurate .
1
vote
0answers
39 views

How/When does Chrome queries Certificate Transparency (CT) log servers to ask for inclusion proof of certificates and how can I debug them?

I’ve been trying to understand how does Chrome interact with CT log servers. According to what I’ve read so far, Chrome sends inclusion proof requests (“GET https:///ct/v2/get-proof-by-hash” - https://...
0
votes
0answers
28 views

Browser Exploiting - Using SyncManager to keep Service Workers alive forever

I just read the paper "Master of Web Puppets: Abusing Web Browsers for Persistent and Stealthy Computation". The authors claim to use the SyncManager Interface in order to keep Service Workers alive ...
3
votes
2answers
112 views

Can Google deduce the visited URLs from Safe Browsing reports?

The Google Chrome Privacy Whitepaper has a part about Safe Browsing, which says (emphasis mine): If you navigate to a URL that appears on the list, Chrome sends a partial URL fingerprint (the ...
5
votes
1answer
135 views

Information obtained from executing Javascript math functions in browser

I came across interesting piece of javascript across few sites. It's executing Javascript math functions such as abs, acos, random etc. thousands of times - or four thousand times in my case, though ...
1
vote
1answer
44 views

local environment development and HTTPS: interaction with Chrome requirement of CT logs

The commonly suggested wisdom for local development environments with HTTPS is to use a self-created Root CA and use certificates issued from that CA. However, Chrome requires Certificate Transparancy ...
0
votes
0answers
89 views

Browser passwords used on multiple domains?

I have 100 domains with authentication backed by the same LDAP database. There is a single-sign on, but it's not implemented with OAuth. That is to say, per user, each domain accepts the same user/...
1
vote
1answer
72 views

How to defend myself against potential malicious browser add-ons?

So previously I asked a question about what type of private data can addons extract from my browser : Can a malicious add-on access internet history and such in Chrome/Firefox? and it turns out if ...
18
votes
2answers
3k views

Can a malicious add-on access internet history and such in Chrome/Firefox?

How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on? How much access can add-ons have? Can they access internet history or maybe even cookies ...
0
votes
5answers
312 views

Is my Google Drive still secure if Chrome was heavily compromised?

I use an Apple eMac desktop computer. I formerly used Safari as my main browser. I migrated to Chrome as it is integrated with Google products. I use Google Drive very extensively as my main ...
0
votes
1answer
159 views

XSS triggered but chrome didn't show popup. What exactly was going on?

Related to my previous question on XSS in canonical link. At the beginning I turned off Chrome's XSS auditor and tried executing XSS with just onload event using following payload which did not ...
0
votes
1answer
38 views

Are there any chrome extension VPNs that use the chrome.vpnProvider API? [closed]

Seems most extensions use the old proxy api which requires giving them full "read and change site data" access. A more recent API is available made for VPNs: https://developer.chrome.com/extensions/...
0
votes
2answers
114 views

What does “This request does not comply with Chrome's Certificate Transparency policy.” in Chrome's Security Tab mean?

When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://...
0
votes
0answers
47 views

On The Use Of Unsanboxed Plugins In The Chrome Browser

The following questions relate to unsandboxed plugins under Settings > Advanced > Content settings > Unsandboxed plugins. The first thing I'd like to know is whether this setting is basically for ...
0
votes
0answers
195 views

Payment Handlers In Google Chrome

Are there any privacy/security risks associated with using payment handlers in Google Chrome? Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
9
votes
2answers
2k views

How to prevent Firefox and Chrome from opening ports in the firewall?

I have noticed that Firefox and Chrome have opened ports for unsolicited inbound traffic in the Windows firewall. This happened with Windows 7 x64 and Windows 10. (Here, I am talking about the ...
1
vote
0answers
61 views

How a browser isolation product is safer than our enterprise-hardened Chrome? [closed]

We have been offered a security product that provides browser isolation but I am not really sure what the benefits could be of such a solution in an enterprise.
3
votes
0answers
85 views

Automatic Downloads in Google Chrome [closed]

The questions I have relate to automatic downloads in Google Chrome, under Settings > Advanced > Content settings. For starters, are there any security risks associated with allowing sites to ask ...
0
votes
2answers
80 views

Private Google account at work

I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
0
votes
1answer
666 views

Random Chrome Notifications and Strange Source Code

My elderly parents are receiving chrome notifications from a strange URL on their iMac: (https://s1.snc.com.ru:443) Example Messages • Pending Payment: Paypal Has Sent You $65,900 • Clean your mac....
3
votes
0answers
90 views

HTML link with “noopener” and/or “noreferrer” in Chrome/Chromium results in unexpected behaviour

There are several attacks possible when embedding links with target="_blank". This is where rel="noopener" and rel="noreferrer" should help. I am expecting that clicking the following link <a ...
-6
votes
1answer
510 views

How to disable obsolete/insecure TLS_RSA ciphers to harden Chrome? [closed]

Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations. February 9, 2019: "Seven researchers from all over the world found --yet again-- another way to break RSA ...
3
votes
1answer
197 views

How does AVG insert its signature into Gmail emails?

I just sent an email from gmail loaded in my Chrome web browser. Also on the Windows 7 computer is AVG "anti-virus". Turns out AVG somehow managed to insert a signature into the email I sent out. ...
6
votes
2answers
194 views

Can a web app fingerprint your device as identical to a native app's fingeprint

I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint. I tried the web ...
0
votes
1answer
89 views

Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby

I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt: chrome.exe attempted ...
1
vote
0answers
31 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
2
votes
1answer
57 views

Does MathML pose a security risk?

MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "...
1
vote
2answers
90 views

When pasting sensitive links or text on Google Chrome bar - does Google store it?

When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google. Does Google store all of them, including that sensitive information?
1
vote
1answer
69 views

Vulnerability scanners reporting Google Chrome vulns even when it is not Installed

I have a machine which does not have Google chrome installed but when I try to scan it using Nexpose and Retina all the Chrome related vulnerabilities are listed in the report and it shows it as ...
8
votes
2answers
1k views

Does Chrome's password manager store plaintext passwords in their databases?

Chrome's password manager allows for users to view their saved passwords on passwords.google.com. The saved passwords can be viewed on different devices as long as the user logs into their Google ...
0
votes
0answers
19 views

Can a limited permission Chrome extension access multidomain cookies?

Can a Chrome extension that's only allowed to "read and modify all data on youtube.com" access or modify data related to my Google account? (Background: The sign in window is hosted at a different ...
1
vote
3answers
543 views

Broken into my office, HDD/SSD stolen. How secure is Chrome password saving feature?

I'm working as a developer in a shared office space, and today when I came to work, my PC no longer booted into windows, only UEFI with error -> couldn't find the primary SSD. I opened up the case on ...
0
votes
1answer
366 views

Certificate works in Chrome + Firefox but not with curl (“unable to get local issuer certificate”) with the recent cacert.pem

I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification. $ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * ...
0
votes
2answers
237 views

How secure are old versions of Chrome?

I realise the generic nature of this post and I apologise in advance. Let's say for instance we were on v58, what resources are out there to "prove our point" that it's insecure and we should upgrade?...
13
votes
1answer
337 views

How private is the data I type in Chrome address bar?

Sometimes, I paste some data in a Chrome tab address bar as a temporary storage. It usually happens when I want to save more then one thing in the clipboard. It's handy because I am always with Chrome ...
0
votes
0answers
28 views

security of <link rel=“canonical”>

today I was a bit surprised to see a <link rel="canonical">-Tag in action: I was reading this news article on my android phone and wanted to share it: https://www.golem.de/news/hyundai-nexo-...
2
votes
1answer
259 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
3
votes
2answers
175 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
0
votes
2answers
193 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
2
votes
1answer
53 views

Server secured with a Certificate from a Custom CA Root: OK on Firefox but KO on Chrome? [duplicate]

The Setup In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL: The Root CA Certificate The ...
11
votes
1answer
967 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
1
vote
2answers
818 views

How is danger / badidea / thisisunsafe justified?

The HSTS standard states the following: 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")...
1
vote
0answers
22 views

Is it possible to open Chrome's databases.db in another MacBook?

According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
0answers
87 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
6
votes
3answers
358 views

Is com.com a Google web site?

With the new Chrome update, I started getting a message at the top of Chrome: When I clicked on Learn More, it took me to Com.com web site. A warning appeared before that "your connection is not ...
3
votes
3answers
466 views

Security benefits of disabling Chrome Incognito mode?

The company I work for has disabled Incognito mode for Chrome (but allows InPrivate windows for Edge) and when I enquired why, I was told it was for security reasons. As a developer, I find Incognito ...