Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

1
vote
0answers
23 views

Chrome on android - export tabs [migrated]

I am have some tab fetish and normally open ~200 tabs on my phone and since time to time sort it...and do some clean up... As my phone died I was a victim of lost of all tabs as chrome tab sync is ...
1
vote
1answer
58 views

How to defend myself against potential malicious browser add-ons?

So previously I asked a question about what type of private data can addons extract from my browser : Can a malicious add-on access internet history and such in Chrome/Firefox? and it turns out if ...
18
votes
2answers
3k views

Can a malicious add-on access internet history and such in Chrome/Firefox?

How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on? How much access can add-ons have? Can they access internet history or maybe even cookies ...
0
votes
5answers
293 views

Is my Google Drive still secure if Chrome was heavily compromised?

I use an Apple eMac desktop computer. I formerly used Safari as my main browser. I migrated to Chrome as it is integrated with Google products. I use Google Drive very extensively as my main ...
0
votes
1answer
85 views

XSS triggered but chrome didn't show popup. What exactly was going on?

Related to my previous question on XSS in canonical link. At the beginning I turned off Chrome's XSS auditor and tried executing XSS with just onload event using following payload which did not ...
0
votes
1answer
32 views

Are there any chrome extension VPNs that use the chrome.vpnProvider API? [closed]

Seems most extensions use the old proxy api which requires giving them full "read and change site data" access. A more recent API is available made for VPNs: https://developer.chrome.com/extensions/...
0
votes
2answers
86 views

What does “This request does not comply with Chrome's Certificate Transparency policy.” in Chrome's Security Tab mean?

When you open up Chrome's DevTools and switch to the Security Tab you'll see the message This request does not comply with Chrome's Certificate Transparency policy. on some origins. (Example: https://...
0
votes
0answers
38 views

On The Use Of Unsanboxed Plugins In The Chrome Browser

The following questions relate to unsandboxed plugins under Settings > Advanced > Content settings > Unsandboxed plugins. The first thing I'd like to know is whether this setting is basically for ...
0
votes
0answers
70 views

Payment Handlers In Google Chrome

Are there any privacy/security risks associated with using payment handlers in Google Chrome? Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
9
votes
2answers
2k views

How to prevent Firefox and Chrome from opening ports in the firewall?

I have noticed that Firefox and Chrome have opened ports for unsolicited inbound traffic in the Windows firewall. This happened with Windows 7 x64 and Windows 10. (Here, I am talking about the ...
1
vote
0answers
59 views

How a browser isolation product is safer than our enterprise-hardened Chrome? [closed]

We have been offered a security product that provides browser isolation but I am not really sure what the benefits could be of such a solution in an enterprise.
3
votes
0answers
82 views

Automatic Downloads in Google Chrome [closed]

The questions I have relate to automatic downloads in Google Chrome, under Settings > Advanced > Content settings. For starters, are there any security risks associated with allowing sites to ask ...
0
votes
2answers
70 views

Private Google account at work

I have an old private tablet at work with my private Google account on it .It's connected to our WiFi, where i logged in with my personal working code. Never use it much as I just play some music on ...
0
votes
1answer
193 views

Random Chrome Notifications and Strange Source Code

My elderly parents are receiving chrome notifications from a strange URL on their iMac: (https://s1.snc.com.ru:443) Example Messages • Pending Payment: Paypal Has Sent You $65,900 • Clean your mac....
2
votes
0answers
68 views

HTML link with “noopener” and/or “noreferrer” in Chrome/Chromium results in unexpected behaviour

There are several attacks possible when embedding links with target="_blank". This is where rel="noopener" and rel="noreferrer" should help. I am expecting that clicking the following link <a ...
-7
votes
1answer
295 views

How to disable obsolete/insecure TLS_RSA ciphers to harden Chrome? [closed]

Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations. February 9, 2019: "Seven researchers from all over the world found --yet again-- another way to break RSA ...
3
votes
1answer
141 views

How does AVG insert its signature into Gmail emails?

I just sent an email from gmail loaded in my Chrome web browser. Also on the Windows 7 computer is AVG "anti-virus". Turns out AVG somehow managed to insert a signature into the email I sent out. ...
6
votes
2answers
136 views

Can a web app fingerprint your device as identical to a native app's fingeprint

I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint. I tried the web ...
0
votes
0answers
50 views

Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby

I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt: chrome.exe attempted ...
1
vote
0answers
20 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
2
votes
1answer
53 views

Does MathML pose a security risk?

MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "...
1
vote
2answers
88 views

When pasting sensitive links or text on Google Chrome bar - does Google store it?

When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google. Does Google store all of them, including that sensitive information?
1
vote
1answer
66 views

Vulnerability scanners reporting Google Chrome vulns even when it is not Installed

I have a machine which does not have Google chrome installed but when I try to scan it using Nexpose and Retina all the Chrome related vulnerabilities are listed in the report and it shows it as ...
8
votes
2answers
908 views

Does Chrome's password manager store plaintext passwords in their databases?

Chrome's password manager allows for users to view their saved passwords on passwords.google.com. The saved passwords can be viewed on different devices as long as the user logs into their Google ...
0
votes
0answers
19 views

Can a limited permission Chrome extension access multidomain cookies?

Can a Chrome extension that's only allowed to "read and modify all data on youtube.com" access or modify data related to my Google account? (Background: The sign in window is hosted at a different ...
1
vote
3answers
424 views

Broken into my office, HDD/SSD stolen. How secure is Chrome password saving feature?

I'm working as a developer in a shared office space, and today when I came to work, my PC no longer booted into windows, only UEFI with error -> couldn't find the primary SSD. I opened up the case on ...
0
votes
1answer
222 views

Certificate works in Chrome + Firefox but not with curl (“unable to get local issuer certificate”) with the recent cacert.pem

I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification. $ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * ...
0
votes
2answers
183 views

How secure are old versions of Chrome?

I realise the generic nature of this post and I apologise in advance. Let's say for instance we were on v58, what resources are out there to "prove our point" that it's insecure and we should upgrade?...
12
votes
1answer
329 views

How private is the data I type in Chrome address bar?

Sometimes, I paste some data in a Chrome tab address bar as a temporary storage. It usually happens when I want to save more then one thing in the clipboard. It's handy because I am always with Chrome ...
0
votes
0answers
26 views

security of <link rel=“canonical”>

today I was a bit surprised to see a <link rel="canonical">-Tag in action: I was reading this news article on my android phone and wanted to share it: https://www.golem.de/news/hyundai-nexo-...
3
votes
1answer
251 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
3
votes
2answers
150 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
0
votes
2answers
151 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
2
votes
1answer
49 views

Server secured with a Certificate from a Custom CA Root: OK on Firefox but KO on Chrome? [duplicate]

The Setup In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL: The Root CA Certificate The ...
12
votes
1answer
957 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
1
vote
2answers
492 views

How is danger / badidea / thisisunsafe justified?

The HSTS standard states the following: 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")...
1
vote
0answers
22 views

Is it possible to open Chrome's databases.db in another MacBook?

According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
0answers
84 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
6
votes
3answers
355 views

Is com.com a Google web site?

With the new Chrome update, I started getting a message at the top of Chrome: When I clicked on Learn More, it took me to Com.com web site. A warning appeared before that "your connection is not ...
3
votes
3answers
402 views

Security benefits of disabling Chrome Incognito mode?

The company I work for has disabled Incognito mode for Chrome (but allows InPrivate windows for Edge) and when I enquired why, I was told it was for security reasons. As a developer, I find Incognito ...
-4
votes
1answer
104 views

Reason behind Chrome not running in root user in kali Linux?

Why does Google Chrome not run as root user by default in Kali Linux? Is it a security issue?
2
votes
1answer
49 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
7
votes
2answers
245 views

Win10: Access other logged on users' memory

How easily can admin users access the data of other users' running processes on Windows 10? Especially webpages loaded by Chrome. Example Context Bob and Alice share a single Windows 10 ...
1
vote
1answer
283 views

Chrome incognito forensic analysis in case of abrupt shutdown

There have been many discussions on how to do forensic analysis when users used incognito mode of Chrome - consensus seems that not impossible, but difficult still. But there's been lack of ...
1
vote
1answer
68 views

How do I block Chrome extensions from making network requests unless whitelisted?

I see extensions such as uMatrix that allow you to whitelist requests for URL patterns. How can I have the same functionality but, instead of for websites I visit, for Chrome extensions I have ...
1
vote
1answer
711 views

HSTS doesn't work on browser when dealing with a self-signed certificate

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to ...
8
votes
2answers
216 views

How to choose Chrome extensions with security in mind

I find myself more and more in need of using Chrome extensions, but the appallingly broad and intrusive permission requirements prevent me from installing any of them. Pretty much every extension I ...
3
votes
1answer
45 views

Prevent reflecting page modified by browser extension

Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc) I don't want anyone but me to see the page modified by this ...
89
votes
4answers
12k views

Chrome generated passwords not high entropy?

On Chrome, if you open a sign up page, it will offer to fill and remember the password field. I did this and got the following sequence of passwords offered as generated: suCipAytAyswed0 ...
0
votes
2answers
7k views

Why Chrome blocks ajax locally?

Could not find dup, so let me know if there is one I am trying to create static one page website (to host it on neocities). I use jquery's load() function for that. It works fine in Firefox (and Edge)...