Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

Filter by
Sorted by
Tagged with
0
votes
0answers
62 views

chromebook: security issues [migrated]

I'm on a school chromebook. After some time, I see this process running: If you zoom in close enough, 3 people "C", "C", and "I" are acessing my computer apparently (...
3
votes
1answer
88 views

How to restrict LAN addresses in a browser?

How to prevent Chrome to connect addresses from LAN to prevent CSRF attacks like this? <img src="http://192.168.0.1/some_action"> Info for other browsers is welcome here too.
0
votes
0answers
26 views

Are my browser's stored passwords safe when my Windows 10 User Account has no password? [closed]

From what I've learnt, most browsers which allow you to save passwords for particular forms and websites (e. g. Google Chrome and Chromium-based web-browsers), encode password based on your Windows ...
4
votes
2answers
170 views

Source code being injected into every website

I had a client contact me today because a website I developed (that deals with sensitive information) wasn't loading correctly on one computer on Chrome. After poking around for a while it appears to ...
2
votes
2answers
121 views

Does a professional website know that person A switches the Chrome “user” and logged into its website with another email address?

Let's say I have account A on site example.com that has a policy of strictly one account per real person. I then create a new Gmail address, use that Gmail address to open a new Chrome user (not ...
-1
votes
0answers
25 views

Employer access to personal icloud email and photos when using company credential on chrome [duplicate]

I was checking my icloud email using chrome signed in with my company credentials on my personal Windows computer at home on my own network. I downloaded an image which turned out to be NSFW and it ...
3
votes
0answers
42 views

Can Chrome extensions access other Chrome extensions' data?

Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
1
vote
1answer
59 views

Can visiting website infect computer? [duplicate]

I have heard online that simply visiting a website can infect a computer. I had an instance recently where someone I know sent me a link but misspelled it. The misspelled link lead to a malicious ...
0
votes
1answer
107 views

Is it possible to setup a phishing “honeypot” for proof-of-concept purposes without getting the host/IP blacklisted?

[Edited title according to comments] In the company I work for we have many clients and vast majority of them have hosting with us and we made their web apps. One client though just applied for cyber ...
2
votes
0answers
62 views

What is the threat-model of a malicious browser-extension accessing the data of *another browser-extension* that is security-critical?

Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" ...
8
votes
2answers
1k views

Chrome allow insecure localhost

I have just stumbled upon what is a very helpful flag in chrome (for developers): chrome://flags/#allow-insecure-localhost The flag is described as: Allow invalid certificates for resources loaded ...
0
votes
0answers
45 views

Does Google Chrome send INCOGNITO search history data to Google? [duplicate]

Type Ctrl + Shift + N. Then type DIVIDED WE FALL and then click enter. Click a search result that takes you to YouTube. Go back to the search results. Retype "DIVIDED WE FALL by Valarie Kaur"...
21
votes
5answers
8k views

Does Google collect and store data about activity done in Incognito mode?

Suppose that someone browses non-Youtube videos (like on Vimeo) in Google Chrome's Incognito mode. Does Google collect and store any data about this activity ("watched videos on Vimeo" ...
-1
votes
1answer
135 views

Google says CVE-2020-15999 was for a zero day exploit found on 2020-10-19, but the CVE record was created on 2020-07-27. What am I missing?

There have been numerous reports in the last week about the Chrome exploit using a bug in the FreeType library. According to reports, this bug was found on 2020-10-19. https://chromereleases....
0
votes
1answer
40 views

Is JQuery in chrome extension a security concern?

This is the relevant part of my manifest.json file: "content_scripts": [ { "css": ["style.css"], "matches": [ "<all_urls>&...
0
votes
0answers
57 views

Is quarantine threats absolutely necessary? Every time I do, all my Chrome tabs crash

I have been talking backwards and forwards with a MalwareByte support, because every time I run 'quarantine threats' all my Chrome tabs crash. This guy keeps asking me to switch Google sync off, and ...
0
votes
1answer
50 views

How To Validate Secure Traffic from Chrome with Element To Matrix.org on Linux

Are you familiar with the Element chat system of https://app.element.io ? Are you familiar with its connections to Matrix.org (for a free account)? Is there a way that I can sniff this traffic on the ...
31
votes
1answer
6k views

“google.com” is not HSTS protected?

Issue: Oftentimes people enter google.com directly in the browser's address bar without including either the http:// or https:// prefixes. Using Chrome DevTools on a fresh incognito session, I ran the ...
0
votes
1answer
197 views

Brute-Forcing a Chrome Login Data file

Say I have a "Login Data" Chrome file that is encrypted with the user's Windows password. Is there a way I can brute-force the file and try to decrypt it using every password possible?
1
vote
1answer
79 views

Chrome extension security

I want to install a Chrome extension called metamask. I do not trust this kind of software. (Maybe because I am a newbie) What can a Chrome extension do on my computer? Is it possible, for example, ...
1
vote
0answers
69 views

How would you follow all JavaScript calls after a click?

I'm using Google Chrome developer tools. Let's say I'm performing a bug bounty activity. I found an obfuscated JS. I know user data goes into this JS and goes out encrypted. I found a few files called ...
0
votes
0answers
82 views

Is Chrome Browser/ Computer compromised by KMSPico?

I recently installed a new windows key for my friend. He was using a hack program previously, known as Auto KMS. So after new keys installation, I used Windows defender to remove AutoKMS program. The ...
4
votes
0answers
164 views

How Are Google Chrome Synced Passwords Encrypted If I Can Reset the Password to My Account

Services like Dashlane and Bitwarden are unable to decrypt your passwords without your Master Password. So, how does Chrome do it when they also state that your passwords are encrypted using your ...
1
vote
1answer
149 views

“Your connection is not private” for specific website, once when opening a new tab

Like many, since March, I've been working from home and using the company's VPN to do my work. Recently, if I open a new tab in Chrome, and navigate to "news.bbc.co.uk", I got the ...
1
vote
1answer
77 views

Does it matter that my browser shows an out-of-date certificate when a website uses service workers?

A website I frequent (a Discourse forum) uses Let's Encrypt TLS certificates which are updated every two months with a valid period of three months. But the certificate information shown by Chrome ...
1
vote
0answers
136 views

Suspicious behavior by Google when verifying users via nodejs

I'm building a user authentication system in Nodejs and use a confirmation email to verify a new account is real. The user creates an account, which prompts him/her to check the email for a URL that ...
1
vote
0answers
168 views

CA certificate somehow not taken by browsers on android [closed]

This is a follow up question related to this answer. In short: I am importing the self signed Root CA certificate into android system via Settings -> Security -> Trusted Credentials -> ...
0
votes
1answer
138 views

DNS spoofing protection in Chrome and Firefox

I'm using hostapd to setup a wireless access point and dnsmasq as a DNS/DHCP server. I defined in dnsmasq to reply with the IP of the access point (10.0.10.1) when it receives a query for www....
0
votes
0answers
48 views

Unable to intercept traffic on android application using burp suite

When I try to intercept the traffic through burp suite, the app itself won't load. This doesn't happen in some applications like Chrome and Gmail but happens on YouTube and other applications. It ...
0
votes
1answer
96 views

Why does Chrome display “Managed by Organisation”? [closed]

My wife inadvertently clicked on a flash player update and suddenly my chrome browser displays that it is being managed by an Organisation. I tried deleting chrome and reinstalling it but nothing ...
0
votes
0answers
11 views

Chrome Malware, Redirects To Ad When I Click Link in Google? [duplicate]

I've been dealing with this Chrome malware for awhile now, and I can't identify where it's coming from. Very occasionally, when I click on a top link in Google, it'll redirect me to a site that looks ...
0
votes
2answers
222 views

Can website detect if I’m using chrome remote desktop?

I was wondering if the website can detect the remote operation of my PC while I’m visiting. For example; I visit one website and click here and there while using my laptop for controlling my desktop ...
0
votes
1answer
68 views

Spam link sets cookie(s) then redirects to google.com - what would be the point of this? Should I be concerned?

Received a spam link about "a package soon to be delivered" via an SMS message. Didn't click it in my phone, but couldn't help myself but to go to the URL in a browser on my laptop :grimace: (not ...
0
votes
0answers
262 views

Chrome extension differences: Urban Shield VS Urban Free VPN proxy Unblocker

What's the difference between these two Chrome extensions, which provide VPN functionality for browsing via Chrome: Urban Shield: https://chrome.google.com/webstore/detail/urban-shield/...
0
votes
0answers
15 views

Google Chrome Unknown Connections In Proxifire [duplicate]

I always using Proxifire in my windows 7 os machine. This app can show all network traffic through the proxy. Here is image of my proxifire : Google chrome is close. So what are those ...
1
vote
1answer
80 views

How do browsers import password data from other browsers?

Specifically, how did the new Microsoft Edge (based on Chromium?) import my passwords from Google Chrome (which are synced to my Google account and supposedly secure)? I'm on Windows 10. Does Windows ...
0
votes
1answer
206 views

Playing a shared video file or viewing a pdf file in “incognito/private mode”

I know how incognito/private tab works. But I'm not sure private mode works as expected in this situation: If someone uses Chrome "incognito/private mode" on Android device and plays a video file or ...
4
votes
0answers
62 views

Can a website on Google Chrome know whether the user actively using the computer?

If I have opened a website in Google Chrome on Windows 10 and it runs in the background, can it spy to see whether I'm actively interacting my computer or the computer runs without any user ...
2
votes
1answer
701 views

Did changes in Google Chrome 80 weaken cookie and password encryption?

According to Arun on StackOverflow “Starting Chrome 80 version, cookies are encrypted using the AES256-GCM algorithm, and the AES encryption key is encrypted with the DPAPI encryption system, and the ...
1
vote
1answer
273 views

Hugoclose.com malware is causing issues in google chrome [closed]

In my MacBook Air, whenever I search something in google, some adds are appearing out of no where and they're hiding the actual search results from google. When I checked the developer tools, I found ...
1
vote
1answer
145 views

Chrome: why is invalid certificate usage for resources loaded from localhost disabled?

In chrome there is a flag called: allow-insecure-localhost. As far as I can tell all it does is block localhost connection over tls if the certificate is self signed. Why is this feature turned off ...
32
votes
5answers
6k views

How do I know if a Google Chrome extension is leaking data?

Many Google Chrome extensions require permissions to read the contents of webpages the user visits. How can the user verify whether and to what extent a certain Chrome extension leaks data?
2
votes
0answers
54 views

DevTool requests full access to YOURPATH, make sure that you do not expose any sensitive information dialog [closed]

I came across this warning message in chrome after I executed a command in the browser inspector, and realised this question had been asked on stackoverflow here but the answers do not contain so much ...
-1
votes
1answer
185 views

Run your own code on chrome:// url?

Recently I've been trying to escape sandbox Chrome OS for fun, bounties, etc. I found you can run straight system commands through chrome:// urls (such as displaying USB Detected message, or something)...
1
vote
0answers
62 views

does pasting a url into a chrome file upload dialog box (windows process) have security issues?

When using Chrome and I select a file for upload on a website that accepts files, a Windows dialog box appears for me to select a file. I can then paste a URL address for a file in the dialog box, ...
1
vote
1answer
143 views

Can Chromebooks be affected by malware from an SD Card?

I've got an SD card that I think might contain infected files. However, those files are from my Windows days. I hear that Chrome OS is pretty hardy, and that it's really only posisble to get damage ...
4
votes
0answers
392 views

How does Chrome's Renderer Code Integrity Protection Work?

I recently heard of Chrome's Renderer Code Integrity Protection, which is apparently supposed to prevent unsigned dlls from being loaded into the chrome.exe process, and figured I'd test what would ...
9
votes
3answers
539 views

Why does Chrome not allow the modification of these headers by extensions?

The Chrome WebRequests API mentions that specific request headers are not available to the onBeforeSendHeaders event, meaning that extensions cannot read and/or modify these headers. Here is an ...
40
votes
1answer
5k views

Can a browser extension (Chrome, Firefox, etc.) read the web console log?

I realized that my bank handles sensitive information in the web console log, so my concern is if any browser extension could read the log?
0
votes
2answers
681 views

Why does Firefox (version 71.0 (64-bit)) indicate “weak encryption” but Google Chrome (Version 79.0.3945.88) does not?

I read that Mozilla uses its own trust certificate store but does "weak encryption" have anything to do with whether the browser trusts the certificate? Has it got anything to do with the signature ...

1
2 3 4 5
10