Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

5
votes
2answers
149 views

Can going to a bad website on firefox, or installing a malcious firefox plugin, infect other parts of my home folder on a Linux system?

BTW, I don't mean root, just a plain user. I'm worried because I'm scared that if I do such things I could infect my Chromium folder. I got a huge case of OCD.
-7
votes
1answer
188 views

How to disable obsolete/insecure TLS_RSA ciphers to harden Chrome? [closed]

Multiple vulnerabilities have basically obsoleted TLS_RSA, CBC and QUIC implementations. February 9, 2019: "Seven researchers from all over the world found --yet again-- another way to break RSA ...
3
votes
3answers
6k views

Is QUIC (Quick UDP Internet Connections) safe to allow through firewall?

Our firewall currently blocks QUIC (UDP 443) traffic which seems to be enabled by default in Google Chrome. Is it safe to allow QUIC or should I wait until it is implemented in all the major browsers? ...
2
votes
1answer
99 views

How does AVG insert its signature into Gmail emails?

I just sent an email from gmail loaded in my Chrome web browser. Also on the Windows 7 computer is AVG "anti-virus". Turns out AVG somehow managed to insert a signature into the email I sent out. ...
4
votes
2answers
84 views

Can a web app fingerprint your device as identical to a native app's fingeprint

I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint. I tried the web ...
0
votes
0answers
15 views

How to see what file is Chrome uploading [migrated]

I think I am infected with a Static.Hotjar.com Malware, I noticed whenever I open the Gamivo website (which sells Steam game keys), on the bottom left corner of Google Chrome it says "Waiting for ...
19
votes
1answer
36k views

Chrome >50: Where can I see the negotiated cipher suite?

This is about Chrome 50 and later. When visiting an https site, where can I find the negotiated cipher suite? I know where to find this info in previous versions of Chrome but I'm not able to find it ...
0
votes
0answers
29 views

Bitdefender showing lot of Getting Suspicious Connection Blocked from Chrome extension Toby

I'm using GetToby Chrome extension to manage my tabs and save them for later. Lately, I've been getting lots of notifications from BitDefender about blocked suspicious attempt: chrome.exe attempted ...
3
votes
2answers
3k views

Remote hack of my computer via Chrome using Google account

I posted this on Google yesterday but I think it deserves more visibility. If what I think might have happened, actually happened, then Chrome may not be secure: Something weird happened yesterday ...
1
vote
0answers
17 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
2
votes
1answer
48 views

Does MathML pose a security risk?

MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "...
1
vote
2answers
84 views

When pasting sensitive links or text on Google Chrome bar - does Google store it?

When I paste some links or sensitive information by mistake on the Google Chrome URL Bar, that might trigger a search on Google. Does Google store all of them, including that sensitive information?
7
votes
2answers
342 views

Does Chrome's password manager store plaintext passwords in their databases?

Chrome's password manager allows for users to view their saved passwords on passwords.google.com. The saved passwords can be viewed on different devices as long as the user logs into their Google ...
1
vote
1answer
63 views

Vulnerability scanners reporting Google Chrome vulns even when it is not Installed

I have a machine which does not have Google chrome installed but when I try to scan it using Nexpose and Retina all the Chrome related vulnerabilities are listed in the report and it shows it as ...
1
vote
2answers
216 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
1
vote
3answers
349 views

Broken into my office, HDD/SSD stolen. How secure is Chrome password saving feature?

I'm working as a developer in a shared office space, and today when I came to work, my PC no longer booted into windows, only UEFI with error -> couldn't find the primary SSD. I opened up the case on ...
0
votes
0answers
16 views

Can a limited permission Chrome extension access multidomain cookies?

Can a Chrome extension that's only allowed to "read and modify all data on youtube.com" access or modify data related to my Google account? (Background: The sign in window is hosted at a different ...
5
votes
1answer
689 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
5
votes
4answers
2k views

Cross-platform browser link highjacking/redirect issue in Chrome

I'm having strange issues using Chrome Version 65.0.3325.181 (Official Build) on PC (Win 7) and OSX (10.11.6) on different systems. Clicks are often being hijacked taking me to different sites (...
0
votes
1answer
92 views

Certificate works in Chrome + Firefox but not with curl (“unable to get local issuer certificate”) with the recent cacert.pem

I am trying to connect to a site behind a firewall, that is why I cannot share the URL for verification. $ curl -vvvv https://example.com:8080/foo/ba/?wsdl --cacert /tmp/cacert-2018-12-05.pem * ...
2
votes
1answer
265 views

How will Certificate Transparency be enforced?

The Chrome team has announced that "[they]’ll be moving forward with [their] plan to require Certificate Transparency for all newly issued, publicly trusted certificates starting in April 2018." It's ...
126
votes
9answers
55k views

How secure is Chrome storing a password?

Whenever I enter a login into a new site, Chrome asks me if it should store the login details. I used to believe this was fairly secure. If someone found my computer unlocked, they could get past the ...
1
vote
2answers
315 views

How is danger / badidea / thisisunsafe justified?

The HSTS standard states the following: 12.1. No User Recourse Failing secure connection establishment on any warnings or errors (per Section 8.4 ("Errors in Secure Transport Establishment")...
3
votes
2answers
133 views

Google Chrome extension wants to be able to “manage apps, extensions…”: reasonable?

One image can tell more than a thousand words... Is what this extension is asking for reasonable? There are (at least?) five actions it is requesting permission that I do not see what it would need ...
2
votes
2answers
801 views

Does using incognito mode protect from browser fingerprinting techniques?

As far as I understand Chrome's and Firefox's incognito modes mean nothing is persisted. Cookies, Offline Storage, IndexedDB, cache, everything is flushed when you exit. Does this still leave a way (...
18
votes
3answers
29k views

Checking domains HSTS status

The Google Chrome browser offers a quick way to check a domain's HSTS (HTTP Strict Transport Security) status via the page chrome://net-internals/#hsts (section Query domain). The query result looks ...
0
votes
2answers
953 views

Google Chrome is redirecting before visiting a shopping website

I notice every few days (~5 days) that when I try to open an Amazon.in URL, before opening that URL, Chrome opens a different link which looks like an affiliate link. This link redirects to the actual ...
12
votes
1answer
325 views

How private is the data I type in Chrome address bar?

Sometimes, I paste some data in a Chrome tab address bar as a temporary storage. It usually happens when I want to save more then one thing in the clipboard. It's handy because I am always with Chrome ...
0
votes
2answers
102 views

How secure are old versions of Chrome?

I realise the generic nature of this post and I apologise in advance. Let's say for instance we were on v58, what resources are out there to "prove our point" that it's insecure and we should upgrade?...
0
votes
0answers
24 views

security of <link rel=“canonical”>

today I was a bit surprised to see a <link rel="canonical">-Tag in action: I was reading this news article on my android phone and wanted to share it: https://www.golem.de/news/hyundai-nexo-...
2
votes
1answer
230 views

Why does my Chrome still trust Thawte certificate?

Thawte certificates are supposed to be invalid since Chrome 70, but I have Chrome 70.0.3538.102 and it accepts certificate of this site just fine. Does anyone know, why that is? Should I be worried?
2
votes
0answers
548 views

Does Chrome cache smartcard PIN?

When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
0
votes
2answers
93 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
2
votes
1answer
39 views

Server secured with a Certificate from a Custom CA Root: OK on Firefox but KO on Chrome? [duplicate]

The Setup In order to protect the very small intranet of the ACME company, which contains two private servers, foo-server and bar-server, I've created with OpenSSL: The Root CA Certificate The ...
1
vote
0answers
21 views

Is it possible to open Chrome's databases.db in another MacBook?

According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
1
vote
0answers
83 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
0
votes
1answer
392 views

Do any browsers support Server Name Indication (SNI) but NOT SHA-2? [closed]

Yes, I know that SHA-2 signature validation is typically done by the operating system (with Mozilla Firefox/NSS and Chrome as of v39 being the exception).
6
votes
3answers
349 views

Is com.com a Google web site?

With the new Chrome update, I started getting a message at the top of Chrome: When I clicked on Learn More, it took me to Com.com web site. A warning appeared before that "your connection is not ...
89
votes
4answers
11k views

Chrome generated passwords not high entropy?

On Chrome, if you open a sign up page, it will offer to fill and remember the password field. I did this and got the following sequence of passwords offered as generated: suCipAytAyswed0 ...
3
votes
3answers
322 views

Security benefits of disabling Chrome Incognito mode?

The company I work for has disabled Incognito mode for Chrome (but allows InPrivate windows for Edge) and when I enquired why, I was told it was for security reasons. As a developer, I find Incognito ...
-4
votes
1answer
99 views

Reason behind Chrome not running in root user in kali Linux?

Why does Google Chrome not run as root user by default in Kali Linux? Is it a security issue?
-1
votes
1answer
446 views

Does Google Chrome read the contents of screen

Lately I noticed that whenever I'm reading an article and I want to search something I read there, as I'm typing the keyword, Chrome autofills it. For example, I was reading a reddit post and someone ...
4
votes
0answers
538 views

non secure connection in youtube

I was browsing a while ago on youtube, I saw it shows an insecure connection even though it was over https. I'm using ghostery and adblock to block trackers but nothing more, I don't think it's the ...
1
vote
1answer
67 views

How do I block Chrome extensions from making network requests unless whitelisted?

I see extensions such as uMatrix that allow you to whitelist requests for URL patterns. How can I have the same functionality but, instead of for websites I visit, for Chrome extensions I have ...
2
votes
1answer
46 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
3
votes
1answer
44 views

Prevent reflecting page modified by browser extension

Suppose there is a trusted browser extension in a chrome browser that modifies the web page (like editing DOM, appending scripts, etc) I don't want anyone but me to see the page modified by this ...
13
votes
1answer
18k views

Does Google Chrome protect against cross site scripting (XSS)?

In Firefox I've been using the NoScript extension to protect myself from certain kinds of malware attacks. NoScript is well known as a very powerful extension for Firefox and introduced protection ...
15
votes
6answers
67k views

How to prevent installation of Google Chrome extensions

How can I prevent the installation of Chrome extensions on desktop?
7
votes
2answers
236 views

Win10: Access other logged on users' memory

How easily can admin users access the data of other users' running processes on Windows 10? Especially webpages loaded by Chrome. Example Context Bob and Alice share a single Windows 10 ...
1
vote
1answer
192 views

Chrome incognito forensic analysis in case of abrupt shutdown

There have been many discussions on how to do forensic analysis when users used incognito mode of Chrome - consensus seems that not impossible, but difficult still. But there's been lack of ...