Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

0
votes
1answer
23 views

Certificate works in Chrome + Firefox but not with curl (“unable to get local issuer certificate”) with the recent cacert.pem

I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification. $ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * ...
-1
votes
0answers
23 views

My browser does not send early data (0-RTT) to nginx web server [on hold]

I have a web server with nginx. I have all configured for TLS 1.3. I started connection with web server with chrome. After about 5 minutes, I access server. But it does not send early data (0-RTT). ...
0
votes
0answers
13 views

Does malware can enter into Iphone or Mac os from chrome/safari in incognito mode [duplicate]

Every day I will open hundreds of websites some of them are SPAM, some of the fake, some sites may have malware content also but I will not download any files from those. After using that sites if I ...
0
votes
2answers
83 views

How secure are old versions of Chrome?

I realise the generic nature of this post and I apologise in advance. Let's say for instance we were on v58, what resources are out there to "prove our point" that it's insecure and we should upgrade?...
12
votes
1answer
312 views

How private is the data I type in Chrome address bar?

Sometimes, I paste some data in a Chrome tab address bar as a temporary storage. It usually happens when I want to save more then one thing in the clipboard. It's handy because I am always with Chrome ...
0
votes
0answers
23 views

security of <link rel=“canonical”>

today I was a bit surprised to see a <link rel="canonical">-Tag in action: I was reading this news article on my android phone and wanted to share it: https://www.golem.de/news/hyundai-nexo-...
2
votes
1answer
199 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
3
votes
2answers
118 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
0
votes
2answers
76 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
2
votes
1answer
38 views

Server secured with a Certificate from a Custom CA Root: OK on Firefox but KO on Chrome? [duplicate]

The Setup In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL: The Root CA Certificate The ...
4
votes
1answer
413 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
1
vote
2answers
198 views

How is danger / badidea / thisisunsafe justified?

The HSTS standard states the following: 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")...
1
vote
0answers
21 views

Is it possible to open Chrome's databases.db in another MacBook?

According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
0answers
79 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
6
votes
3answers
340 views

Is com.com a Google web site?

With the new Chrome update, I started getting a message at the top of Chrome: When I clicked on Learn More, it took me to Com.com web site. A warning appeared before that "your connection is not ...
3
votes
3answers
275 views

Security benefits of disabling Chrome Incognito mode?

The company I work for has disabled Incognito mode for Chrome (but allows InPrivate windows for Edge) and when I enquired why, I was told it was for security reasons. As a developer, I find Incognito ...
-4
votes
1answer
91 views

Reason behind Chrome not running in root user in kali Linux?

Why does Google Chrome not run as root user by default in Kali Linux? Is it a security issue?
0
votes
0answers
46 views

Obtain Browser TLS Diagnostics

I am writing a TLS server in Java that requests (not requires) a client cert. I have a Java TLS client that works fine. But if I point a browser at it (Edge or Chrome) the browser just abruptly ...
2
votes
1answer
45 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
7
votes
2answers
231 views

Win10: Access other logged on users' memory

How easily can admin users access the data of other users' running processes on Windows 10? Especially webpages loaded by Chrome. Example Context Bob and Alice share a single Windows 10 ...
1
vote
1answer
139 views

Chrome incognito forensic analysis in case of abrupt shutdown

There have been many discussions on how to do forensic analysis when users used incognito mode of Chrome - consensus seems that not impossible, but difficult still. But there's been lack of ...
1
vote
1answer
64 views

How do I block Chrome extensions from making network requests unless whitelisted?

I see extensions such as uMatrix that allow you to whitelist requests for URL patterns. How can I have the same functionality but, instead of for websites I visit, for Chrome extensions I have ...
1
vote
1answer
264 views

HSTS doesn't work on browser when dealing with a self-signed certificate

We have a web portal and I need to add HSTS header in the response. Ours is an on-premise solution, so we use a self-signed certificate. I have added the hsts header in the response & I need to ...
8
votes
2answers
205 views

How to choose Chrome extensions with security in mind

I find myself more and more in need of using Chrome extensions, but the appallingly broad and intrusive permission requirements prevent me from installing any of them. Pretty much every extension I ...
3
votes
1answer
43 views

Prevent reflecting page modified by browser extension

Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc) I don't want anyone but me to see the page modified by this ...
88
votes
4answers
11k views

Chrome generated passwords not high entropy?

On Chrome, if you open a sign up page, it will offer to fill and remember the password field. I did this and got the following sequence of passwords offered as generated: suCipAytAyswed0 ...
0
votes
2answers
1k views

Why Chrome blocks ajax locally?

Could not find dup, so let me know if there is one I am trying to create static one page website (to host it on neocities). I use jquery's load() function for that. It works fine in Firefox (and Edge)...
2
votes
1answer
235 views

How will Certificate Transparency be enforced?

The Chrome team has announced that "[they]’ll be moving forward with [their] plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018." It's ...
11
votes
2answers
2k views

Why do Chrome and Firefox report a different server certificate and issuer than OpenSSL?

When I visit https://somesite.org using Chrome or Firefox and inspect the server certificate, everything looks OK to me. I see SSL Server Certificate, CN, O, OU that appears to match somesite.org ...
0
votes
1answer
171 views

How could this SSO implementation possibly work without browser cookies?

Our corporate Windows 7 desktop setup is now using SSO with our Confluence instance (browser-based wiki-type website) but the strangest thing is that even after logging out AND clearing the browser ...
1
vote
2answers
379 views

How to remove or at least change password from browser memory dump file [duplicate]

I am working with JSP. So when a user submits a form, all the form fields say username and password gets stored in browser memory dump file in clear text. I even tried with JSP hidden fields, but ...
2
votes
2answers
329 views

Computer began downloading hundreds of blobs then froze

While my mother was trying to sign into her bank account, the download bar in Chrome filled up with hundreds of downloads. Her computer then froze so she restarted it and it seemed to work fine, and ...
126
votes
9answers
33k views

What stops Google from saving all the information on my computer through Google Chrome?

I noticed that in Google Chrome, if I type in file:///C:/Users/MyUsername/Desktop/ it shows me all of the folders on my Desktop, and I can type open up PDFs and such in chrome just by typing in the ...
3
votes
1answer
275 views

Google's Certificate Fingerprint doesn't match with the Fingerprints in the Chrome's “net-internals” configurations

As you may know, you can query chrome's HSTS/PKP sets for a domain in the page chrome://net-internals as below: As you see above, there are four SHA256 hash values (in the middle of page and in ...
2
votes
1answer
227 views

Why does Chromes XSS filter block injection into HTML element, but not into attribute?

I have this vulnerable code which takes a GET parameter, and puts it inside a HTML element (h1) as well as inside a HTML attribute (data-text): $data = $_GET["payload"]; echo "<h1>" .$data. "&...
4
votes
1answer
168 views

Inspecting code elements in browser when logging in

When I use the built-in Chrome inspect element, click on the networking tab and view a login.action file or session file, it shows the password in plain text. Is this normal?
0
votes
1answer
242 views

Does the Google Chrome Android Application encrypt data

I am working on a packet analysis application for Android, and I am having difficulties analysing data sent to an HTTP website. I was wondering if this is to do with my application, or does the Google ...
-1
votes
1answer
209 views

Secure way to run Flash on Chrome?

I kinda addicted to Little Big Snake, an online game that requires Flash. I'm trying to find a secure way to play this game on Ubuntu using Chrome. I tried Firejail but the game is very laggy with it....
2
votes
2answers
67 views

Is my (Chrome) email address available to websites when I'm logged into Chrome?

When I'm logged into Chrome (e.g. with my Gmail account) can websites view/obtain the email address associated with my Google/Chrome account? For example, as a means to "recognize" me?
5
votes
4answers
2k views

Cross-platform browser link highjacking/redirect issue in Chrome

I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems. Clicks are often being hijacked taking me to different sites (...
2
votes
1answer
78 views

Chrome popup - what if button labels for “Accept/Cancel” are exchanged?

Almost all websites show inline modal popups in chrome. How can I be sure that "Cancel" is really cancel and "OK/accept/allow" are properly labeled by the website?
3
votes
1answer
89 views

How to Send Decoded URI?

I'm working in Burp and received an interesting response when sending a decoded string as a GET request. Copying/pasting the same string into a browser, the string is automatically encoded by the ...
0
votes
0answers
40 views

Is Chrome + SOCKS5 anonymous enough to bypass second registration protection [duplicate]

Which level of ansonymyzation is enough if I'm not going to commit a crime but want to bypass a second registration rule at a general purpose site? Is Chrome + SOCKS5 enough for this? Which ...
4
votes
1answer
144 views

Are browsers still vulnerable to IDN homograph attacks?

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/ Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple ...
0
votes
0answers
84 views

If I'm using private mode for google chrome and a free web proxy, is it still possible for the school to monitor what I'm looking up on my macbook? [duplicate]

A quick question just be safe, is it still possible for a school to monitor what I'm looking up and what websites I'm accessing if I'm in private mode on google chrome canary while also using ...
1
vote
2answers
203 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
29
votes
1answer
4k views

Conflicting security messages about “chrome://settings” page; is it secure or not?

Accessing the chrome://settings page, I see two things contradicting each other: The ribbon below the address bar shows "You're viewing a secure Chromium Page." On the other hand, the security ...
2
votes
1answer
506 views

What does Chrome use as the key for decrypting my saved passwords?

When using Chrome, Chrome offers to remember my password on non-Google sites. If my Google password is the key used to decrypt the other passwords that Chrome stores for me, wouldn't Chrome have to ...
1
vote
0answers
407 views

Bypassing the minimum size limit of a popup window in Chrome?

Recently I have come across several popup windows in chrome that somehow bypass the minimum height and width of a new window the browser usually imposes allowing them to hide mostly under the task bar,...
2
votes
1answer
982 views

Revoked cert not showing revoked in Chrome 64.0.3282.186

As far as I can tell (ssllabs.com / ssldecoder.org) the certificate for www.sarahah.com has been revoked: Serial C1:18:2F:1A:91:A9:0E:03 CRL - Revoked on CRL: http://crl.godaddy.com/gdig2s1-792.crl ...