Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

2
votes
1answer
78 views

Chrome popup - what if button labels for “Accept/Cancel” are exchanged?

Almost all websites show inline modal popups in chrome. How can I be sure that "Cancel" is really cancel and "OK/accept/allow" are properly labeled by the website?
3
votes
1answer
95 views

How to Send Decoded URI?

I'm working in Burp and received an interesting response when sending a decoded string as a GET request. Copying/pasting the same string into a browser, the string is automatically encoded by the ...
0
votes
0answers
40 views

Is Chrome + SOCKS5 anonymous enough to bypass second registration protection [duplicate]

Which level of ansonymyzation is enough if I'm not going to commit a crime but want to bypass a second registration rule at a general purpose site? Is Chrome + SOCKS5 enough for this? Which ...
4
votes
1answer
162 views

Are browsers still vulnerable to IDN homograph attacks?

Is it not possible for Chrome and Firefox to protect against this > https://www.аррӏе.com/ Navigating to that above (fake) apple website using Firefox 59.0.2 doesn't actually take me to the apple ...
0
votes
0answers
84 views

If I'm using private mode for google chrome and a free web proxy, is it still possible for the school to monitor what I'm looking up on my macbook? [duplicate]

A quick question just be safe, is it still possible for a school to monitor what I'm looking up and what websites I'm accessing if I'm in private mode on google chrome canary while also using ...
1
vote
2answers
217 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
29
votes
1answer
4k views

Conflicting security messages about “chrome://settings” page; is it secure or not?

Accessing the chrome://settings page, I see two things contradicting each other: The ribbon below the address bar shows "You're viewing a secure Chromium Page." On the other hand, the security ...
2
votes
1answer
556 views

What does Chrome use as the key for decrypting my saved passwords?

When using Chrome, Chrome offers to remember my password on non-Google sites. If my Google password is the key used to decrypt the other passwords that Chrome stores for me, wouldn't Chrome have to ...
1
vote
0answers
429 views

Bypassing the minimum size limit of a popup window in Chrome?

Recently I have come across several popup windows in chrome that somehow bypass the minimum height and width of a new window the browser usually imposes allowing them to hide mostly under the task bar,...
2
votes
1answer
1k views

Revoked cert not showing revoked in Chrome 64.0.3282.186

As far as I can tell (ssllabs.com / ssldecoder.org) the certificate for www.sarahah.com has been revoked: Serial C1:18:2F:1A:91:A9:0E:03 CRL - Revoked on CRL: http://crl.godaddy.com/gdig2s1-792.crl ...
4
votes
3answers
2k views

Why does Chrome tell me that the CSP 'require-sri-for' directive is implemented behind a flag which is currently disabled?

In my Content Security Policy I have included require-sri-for script. However, in the Chrome console I get a notice (not an error, just info): The Content-Security-Policy directive 'require-sri-for'...
2
votes
1answer
336 views

Suspicious Autofill on Chrome

I was looking at signing up for an online account at a reputable web site (Vanguard) when I noticed something suspicious. When the site prompted me with a form to enter my name, I noticed--as usual--...
3
votes
2answers
57 views

Testing an untrusted browser extension securely on macOS

I have received a .zip file containg a browser extension for Google Chrome. How can I test this safely? Current options I consider: 1) Using a VM. Installing VirtualBox on my macos, and then running ...
1
vote
1answer
244 views

NSFW Website loaded on home network then open at work [duplicate]

I use my personal laptop at work. Yesterday evening I had a NSFW website open and didnt close the tab in Chrome. At work, I connected to my works network and then immediately closed the tab without ...
2
votes
1answer
331 views

Does Chrome respect the X-DNS-Prefetch-Control header?

If my web page returns X-DNS-Prefetch-Control=off, will Chrome do DNS prefetch for links like these?: <link rel="dns-prefetch" href="http://www.spreadfirefox.com/"> I know Firefox and Chromium ...
0
votes
1answer
513 views

Chrome Process shelljacket

noticed today this process running on google chrome task manager referencing http://shelljacket.us If I closed it will restart automatically in a few seconds. Can anyone confirm if this is safe? How ...
32
votes
3answers
8k views

Does “Not Secure” mean HTTP?

I work for a corporation and we are all given a kind of employee login system whose URL goes like this in the image below. (Sorry, I cannot disclose the full URL.) I thought "Not Secure" had ...
0
votes
2answers
772 views

Is it safe and secure to disable sandbox of google chrome in Kali Linux or any distribution of Linux?

I have installed chrome on Kali Linux. But It doesn't run. After searching on the internet I found a solution in which you have to disable sandbox if you wanna run google chrome as a root user. ...
2
votes
2answers
113 views

Is there a way to find the SSL certificate used for one specific browser-server SSL communication?

Chrome has a history of HTTPS sites I have accessed, I would like to know if there is somewhere Chrome would have stored details about the SSL certificate used to establish the connections to the ...
1
vote
1answer
100 views

Are Chrome file system API not supercookies? Why are people not worried about them?

Chrome has a file system API that seems to persist through normal clearing of the cache, etc. (In fact, I'm not sure if there's any built-in way to clear this data globally.) Isn't this a security ...
6
votes
2answers
2k views

Can malicious Javascript in local HTML -file send files to internet in Firefox/Chrome?

Download example.html -file from random website to my computer desktop Open example.html -file from desktop with Google Chrome Now Chrome executes javascript from example.html -file that searches ...
2
votes
2answers
426 views

How to confirm if a site is using Device Fingerprinting

Is it possible to confirm if a site is using Device Fingerprinting? When the site owner uses JavaScript, is there something we can look for in the script to confirm if a website is using device ...
4
votes
1answer
1k views

Google Chrome weird random Cipher Suite

This websites gives you information on the SSL cipher suites your browser supports for securing HTTPS connections. If you browse it with Google Chrome, you'll probably see some weird Cipher Suites in ...
6
votes
1answer
79 views

Autofill on (untrusted) websites

Consider a website using https which presents a login form on the home page. Today I visited such a website, which I have a login and password for, and for the first time I was presented with a ...
-1
votes
1answer
158 views

Ad window popping up on Windows 10. Am I infected?

I was working with my PC (Windows 10 Fall Creators Update version 1709, build 16299.64) and this ad appeared in the corner: I've never seen such a window before. I suspected it came from Telegram, ...
65
votes
6answers
12k views

Are there objective reasons to not allow Google Chrome extensions, but to allow Firefox extensions?

Recently, the company I work for has forbidden usage of any extensions in Chrome. They also do not allow account sync. This affected virtually all Web developers since they use Chrome to test their ...
0
votes
1answer
480 views

Intercepting with Burp does not work - alternative ways

When doing bug bounty, there are some sites, which prohibit for good reasons to intercept the requests and responses (with SSL) to the site with Burp and other proxies. So I have the problem to get ...
0
votes
2answers
712 views

HTTPS connection issue on Chrome/Chromium/Opera

I am trying to build a light web server on an embedded device, and trying to add HTTPS to it by introducing mbedTLS. I can use Firefox or IE to make connections without any problem. However, when ...
1
vote
0answers
54 views

Restricting user sign-in on Chrome for Business

I'm currently evaluating the configuration of Chrome for Business in a corporate environment. There is a setting which prevents users from signing into Chrome with their personal accounts. My gut ...
-1
votes
2answers
2k views

Chrome and Firefox showing errors even after importing latest CA certificate for Burp Suite

I am using Chrome 61.0.3163.100 and Firefox 39 on Windows 7 32-bit with Burp Suite v1.7. I have imported latest CA certificate for Burp Suite. In spite of which it's not working for sites with HSTS ...
0
votes
1answer
664 views

Why can't I open the Chrome settings page from JavaScript?

Please consider this simple method which opens a new tab in JavaScript: <!DOCTYPE html> <html> <body> <p>Click the button to open a new browser window.</p> <button ...
126
votes
9answers
55k views

How secure is Chrome storing a password?

Whenever I enter a login into a new site, Chrome asks me if it should store the login details. I used to believe this was fairly secure. If someone found my computer unlocked, they could get past the ...
2
votes
0answers
549 views

Does Chrome cache smartcard PIN?

When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
22
votes
2answers
1k views

Is there a way to make the browser remove the login-password from it's memory immediately, like Chrome seems to do on accounts.google.com?

I did some testing, and found that a memory dump of Chrome doesn't hold the password of gmail.com/Google after logging in to that site (the login happens on accounts.google.com). (My System is ...
-1
votes
0answers
73 views

Spoof local/internal IP address on browser [duplicate]

I found this website and I didn't knew you could get the local ip of a computer with php. I also found how to do it here. So I am wondering if anyone knows how to spoof this. Also, if you know how to ...
7
votes
1answer
4k views

How does Google Chrome manage trusted root certificates

Unlike Mozilla Firefox, I've always assumed that Google Chrome does not come with its own certificate trust store, but uses that of the OS. At least on Windows 7 any certificate management related ...
1
vote
0answers
219 views

Check if a Websocket connection origins from a Chrome extension [closed]

I am writing an application that communicates with a Chrome extension via websocket connection. I wonder if there is a way to detect whether the connection actually origins from the extension. The ...
2
votes
2answers
198 views

How to view all the certificates that are loaded in to Chrome or any browsers or in to the OS?

In Chrome, to view the certificate details of the site you are browsing, you can do a SHIFT+CTRL+I or navigate to: More Tools>> Developer Tools >> Security Tab. But this will show you the details of ...
1
vote
1answer
732 views

Can my computer will be compromised by uBlock/Adblock filter list

uBlock is open source and suppose I trust the author. But filter lists are something that is maintained by other people. Is it possible to add something to filter list to compromise computer/browser, ...
8
votes
4answers
951 views

What are the effects of the Chrome Web Developer extension hijack?

Today, the owner of the rather popular Web Developer toolbar noticed it had been hijacked and replaced with a malicious version. He disabled it, but the malicious version (diff) had been in the wild ...
4
votes
0answers
539 views

non secure connection in youtube

I was browsing a while ago on youtube, I saw it shows an insecure connection even though it was over https. I'm using ghostery and adblock to block trackers but nothing more, I don't think it's the ...
3
votes
2answers
3k views

Remote hack of my computer via Chrome using Google account

I posted this on Google yesterday but I think it deserves more visibility. If what I think might have happened, actually happened, then Chrome may not be secure: Something weird happened yesterday ...
1
vote
0answers
551 views

Is this 0-day RCE Exploit for Chrome fake?

I found this guy claiming that he has a 0-day Exploit for Chrome, Firefox and Windows 10, but to me it seems to be fake... Video - 0day RCE Exploit for Google Chrome 59.0.3071.86 Here is video for ...
2
votes
4answers
478 views

Should I be concerned about Wayback Machine trying to load scripts from unauthenticated sources?

I regularly use Wayback Machine to help find archived versions of webpages that have been taken down or are other otherwise unavailable. While using the site, I noticed a peculiar warning in Google ...
0
votes
1answer
237 views

Help! What is this remote takeover / malware from a pop up, and what does it do? [duplicate]

I was recently on yts.pe a torrent distribution site. When I clicked on a torrent, there was a pop up, which Chrome totally didn't block, even though it is set to block all pop-ups. Here are the ...
1
vote
1answer
5k views

How to force browser to trust a self-signed cert

In our Intranet. we have a site (https://site1) configured with SSL using a generated certificate for a different site URL (https://site2). Chrome/FF/IE/Edge browsers are showing invalid certificate ...
1
vote
2answers
2k views

Allowing a website MIDI access from Chrome

A video website that I occasionally use has gone mute. I received this prompt to give this website MIDI access: Is this safe to grant? Youtube and other websites do still play sound without any ...
0
votes
1answer
106 views

Store password in Chrome exclusively online

I have read about the functioning of Chrome for storing passwords. I realized that it stores an encrypted sql database locally and it also stores them online. I find it more secure to have them only ...
4
votes
1answer
198 views

Prevent Chrome extensions from betraying me

As has been discussed in this answer, a flaw with the Chrome Web Store is that an honest-but-naive developer may sell a popular browser extension to someone like Techno SoLotions, assuming that Techno ...
2
votes
3answers
3k views

Do websockets represent a security problem to my local machine?

To work around a problem with IntelliJ, I have been recommended to configure my local Docker daemon to work on port 2375 without TLS authentication. I am concerned however that a malicious website ...