Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

-7
votes
1answer
188 views

How to disable obsolete/insecure TLS_RSA ciphers to harden Chrome? [closed]

Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations. February 9, 2019: "Seven researchers from all over the world found --yet again-- another way to break RSA ...
2
votes
1answer
99 views

How does AVG insert its signature into Gmail emails?

I just sent an email from gmail loaded in my Chrome web browser. Also on the Windows 7 computer is AVG "anti-virus". Turns out AVG somehow managed to insert a signature into the email I sent out. ...
4
votes
2answers
84 views

Can a web app fingerprint your device as identical to a native app's fingeprint

I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint. I tried the web ...
0
votes
0answers
15 views

How to see what file is Chrome uploading [migrated]

I think I am infected with a Static.Hotjar.com Malware, I noticed whenever I open the Gamivo website (which sells Steam game keys), on the bottom left corner of Google Chrome it says "Waiting for ...
0
votes
0answers
29 views

Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby

I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt: chrome.exe attempted ...
1
vote
0answers
17 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
2
votes
1answer
48 views

Does MathML pose a security risk?

MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "...
1
vote
2answers
84 views

When pasting sensitive links or text on Google Chrome bar - does Google store it?

When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google. Does Google store all of them, including that sensitive information?
1
vote
1answer
63 views

Vulnerability scanners reporting Google Chrome vulns even when it is not Installed

I have a machine which does not have Google chrome installed but when I try to scan it using Nexpose and Retina all the Chrome related vulnerabilities are listed in the report and it shows it as ...
7
votes
2answers
342 views

Does Chrome's password manager store plaintext passwords in their databases?

Chrome's password manager allows for users to view their saved passwords on passwords.google.com. The saved passwords can be viewed on different devices as long as the user logs into their Google ...
0
votes
0answers
16 views

Can a limited permission Chrome extension access multidomain cookies?

Can a Chrome extension that's only allowed to "read and modify all data on youtube.com" access or modify data related to my Google account? (Background: The sign in window is hosted at a different ...
1
vote
3answers
349 views

Broken into my office, HDD/SSD stolen. How secure is Chrome password saving feature?

I'm working as a developer in a shared office space, and today when I came to work, my PC no longer booted into windows, only UEFI with error -> couldn't find the primary SSD. I opened up the case on ...
0
votes
1answer
92 views

Certificate works in Chrome + Firefox but not with curl (“unable to get local issuer certificate”) with the recent cacert.pem

I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification. $ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * ...
0
votes
2answers
102 views

How secure are old versions of Chrome?

I realise the generic nature of this post and I apologise in advance. Let's say for instance we were on v58, what resources are out there to "prove our point" that it's insecure and we should upgrade?...
12
votes
1answer
325 views

How private is the data I type in Chrome address bar?

Sometimes, I paste some data in a Chrome tab address bar as a temporary storage. It usually happens when I want to save more then one thing in the clipboard. It's handy because I am always with Chrome ...
0
votes
0answers
24 views

security of <link rel=“canonical”>

today I was a bit surprised to see a <link rel="canonical">-Tag in action: I was reading this news article on my android phone and wanted to share it: https://www.golem.de/news/hyundai-nexo-...
2
votes
1answer
230 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
3
votes
2answers
133 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
0
votes
2answers
93 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
2
votes
1answer
39 views

Server secured with a Certificate from a Custom CA Root: OK on Firefox but KO on Chrome? [duplicate]

The Setup In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL: The Root CA Certificate The ...
5
votes
1answer
689 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
1
vote
2answers
314 views

How is danger / badidea / thisisunsafe justified?

The HSTS standard states the following: 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")...
1
vote
0answers
21 views

Is it possible to open Chrome's databases.db in another MacBook?

According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
0answers
83 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
6
votes
3answers
349 views

Is com.com a Google web site?

With the new Chrome update, I started getting a message at the top of Chrome: When I clicked on Learn More, it took me to Com.com web site. A warning appeared before that "your connection is not ...
3
votes
3answers
322 views

Security benefits of disabling Chrome Incognito mode?

The company I work for has disabled Incognito mode for Chrome (but allows InPrivate windows for Edge) and when I enquired why, I was told it was for security reasons. As a developer, I find Incognito ...
-4
votes
1answer
99 views

Reason behind Chrome not running in root user in kali Linux?

Why does Google Chrome not run as root user by default in Kali Linux? Is it a security issue?
2
votes
1answer
46 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
7
votes
2answers
236 views

Win10: Access other logged on users' memory

How easily can admin users access the data of other users' running processes on Windows 10? Especially webpages loaded by Chrome. Example Context Bob and Alice share a single Windows 10 ...
1
vote
1answer
192 views

Chrome incognito forensic analysis in case of abrupt shutdown

There have been many discussions on how to do forensic analysis when users used incognito mode of Chrome - consensus seems that not impossible, but difficult still. But there's been lack of ...
1
vote
1answer
67 views

How do I block Chrome extensions from making network requests unless whitelisted?

I see extensions such as uMatrix that allow you to whitelist requests for URL patterns. How can I have the same functionality but, instead of for websites I visit, for Chrome extensions I have ...
1
vote
1answer
458 views

HSTS doesn't work on browser when dealing with a self-signed certificate

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to ...
8
votes
2answers
208 views

How to choose Chrome extensions with security in mind

I find myself more and more in need of using Chrome extensions, but the appallingly broad and intrusive permission requirements prevent me from installing any of them. Pretty much every extension I ...
3
votes
1answer
44 views

Prevent reflecting page modified by browser extension

Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc) I don't want anyone but me to see the page modified by this ...
89
votes
4answers
11k views

Chrome generated passwords not high entropy?

On Chrome, if you open a sign up page, it will offer to fill and remember the password field. I did this and got the following sequence of passwords offered as generated: suCipAytAyswed0 ...
0
votes
2answers
4k views

Why Chrome blocks ajax locally?

Could not find dup, so let me know if there is one I am trying to create static one page website (to host it on neocities). I use jquery's load() function for that. It works fine in Firefox (and Edge)...
2
votes
1answer
265 views

How will Certificate Transparency be enforced?

The Chrome team has announced that "[they]’ll be moving forward with [their] plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018." It's ...
11
votes
2answers
2k views

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me. I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
0
votes
1answer
186 views

How could this SSO implementation possibly work without browser cookies?

Our corporate Windows 7 desktop setup is now using SSO with our Confluence instance (browser-based wiki-type website) but the strangest thing is that even after logging out AND clearing the browser ...
1
vote
2answers
433 views

How to remove or at least change password from browser memory dump file [duplicate]

I am working with JSP. So when a user submits a form, all the form fields say username and password gets stored in browser memory dump file in clear text. I even tried with JSP hidden fields, but ...
2
votes
2answers
338 views

Computer began downloading hundreds of blobs then froze

While my mother was trying to sign into her bank account, the download bar in Chrome filled up with hundreds of downloads. Her computer then froze so she restarted it and it seemed to work fine, and ...
126
votes
9answers
34k views

What stops Google from saving all the information on my computer through Google Chrome?

I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the ...
3
votes
1answer
348 views

Google's Certificate Fingerprint doesn't match with the Fingerprints in the Chrome's “net-internals” configurations

As you may know, you can query chrome's HSTS/PKP sets for a domain in the page chrome://net-internals as below: As you see above, there are four SHA256 hash values (in the middle of page and in ...
2
votes
1answer
228 views

Why does Chromes XSS filter block injection into HTML element, but not into attribute?

I have this vulnerable code which takes a GET parameter, and puts it inside a HTML element (h1) as well as inside a HTML attribute (data-text): $data = $_GET["payload"]; echo "<h1>" .$data. "&...
4
votes
1answer
168 views

Inspecting code elements in browser when logging in

When I use the built-in Chrome inspect element, click on the networking tab and view a login.action file or session file, it shows the password in plain text. Is this normal?
0
votes
1answer
275 views

Does the Google Chrome Android Application encrypt data

I am working on a packet analysis application for Android, and I am having difficulties analysing data sent to an HTTP website. I was wondering if this is to do with my application, or does the Google ...
-1
votes
1answer
214 views

Secure way to run Flash on Chrome?

I kinda addicted to Little Big Snake, an online game that requires Flash. I'm trying to find a secure way to play this game on Ubuntu using Chrome. I tried Firejail but the game is very laggy with it....
2
votes
2answers
67 views

Is my (Chrome) email address available to websites when I'm logged into Chrome?

When I'm logged into Chrome (e.g. with my Gmail account) can websites view/obtain the email address associated with my Google/Chrome account? For example, as a means to "recognize" me?
5
votes
4answers
2k views

Cross-platform browser link highjacking/redirect issue in Chrome

I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems. Clicks are often being hijacked taking me to different sites (...
2
votes
1answer
78 views

Chrome popup - what if button labels for “Accept/Cancel” are exchanged?

Almost all websites show inline modal popups in chrome. How can I be sure that "Cancel" is really cancel and "OK/accept/allow" are properly labeled by the website?