Skip to main content

Questions tagged [chrome]

Popular web browser by Google, see chrome.google.com for more information.

58 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11 votes
0 answers
32k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
inferno's user avatar
  • 111
6 votes
1 answer
3k views

Payment Handlers In Google Chrome

Are there any privacy/security risks associated with using payment handlers in Google Chrome? Somehow, the idea of having my financial information stored in a browser makes me feel uncomfortable. I ...
John Anderson's user avatar
5 votes
0 answers
222 views

Is chrome not blocking all third party cookies?

I opened a website 99acres.com in incognito windows on two browsers on a Macbook. Following are the settings: Chrome Version: 100.0.4896.75 (latest) Third Party cookies: Disabled Firefox Version: ...
Pardhu's user avatar
  • 151
5 votes
0 answers
671 views

Can Chrome extensions access other Chrome extensions' data?

Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
Andrew's user avatar
  • 51
4 votes
0 answers
275 views

How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?

This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
eee's user avatar
  • 41
4 votes
0 answers
260 views

What are the potential vulnerabilities with containerized rootless Chrome and --no-sandbox?

I'm evaluating running Chromium without native sandboxing in a rootless container. A few points: You can containerize Chrome using rootless containers with something like podman. This will utilize ...
Evan Carroll's user avatar
  • 2,843
4 votes
0 answers
1k views

How does Chrome's Renderer Code Integrity Protection Work?

I recently heard of Chrome's Renderer Code Integrity Protection, which is apparently supposed to prevent unsigned dlls from being loaded into the chrome.exe process, and figured I'd test what would ...
Nick Phorus's user avatar
4 votes
2 answers
812 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
Nathanal Lenner's user avatar
4 votes
1 answer
11k views

Why did Chrome show my connection to Youtube as not secure?

I was browsing on Youtube a while ago, when I noticed that Chrome showed it as an insecure connection even though it was over HTTPS. I'm using Ghostery and Adblock to block trackers but nothing more, ...
sshcarex's user avatar
3 votes
0 answers
153 views

Can a website on Google Chrome know whether the user actively using the computer?

If I have opened a website in Google Chrome on Windows 10 and it runs in the background, can it spy to see whether I'm actively interacting my computer or the computer runs without any user ...
Christian's user avatar
  • 1,936
3 votes
1 answer
704 views

What is this URL that loads each time Google Chrome spawns?

What does this URL do that opens each time Google Chrome loads? http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0....
user3290171's user avatar
3 votes
0 answers
341 views

How/When does Chrome queries Certificate Transparency (CT) log servers to ask for inclusion proof of certificates and how can I debug them?

I’ve been trying to understand how does Chrome interact with CT log servers. According to what I’ve read so far, Chrome sends inclusion proof requests (“GET https:///ct/v2/get-proof-by-hash” - https://...
flopoe's user avatar
  • 31
3 votes
0 answers
829 views

HTML link with "noopener" and/or "noreferrer" in Chrome/Chromium results in unexpected behaviour

There are several attacks possible when embedding links with target="_blank". This is where rel="noopener" and rel="noreferrer" should help. I am expecting that clicking the following link <a ...
Anderson's user avatar
  • 131
3 votes
0 answers
169 views

Mechanisms of built-in password managers in browser

I am researching for auto-fill mechanisms in built-in web-browsers password managers. Using windows hosts file i am redirecting browser query to my web-server where i am storing the full copy of ...
Giuseppe Baldinini's user avatar
3 votes
0 answers
6k views

Does this list every Chrome extension/addin that may leak privacy?

I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party. To that end, I discovered: chrome://net-...
makerofthings7's user avatar
3 votes
1 answer
1k views

Can my G Suite admin see my browsing history if: I am in incognito mode on iPad Chrome?

Can my G suite admin see by browsing history if: I am in incognito mode on iPad Chrome? iPadOS beta 3. I'm signed in with a G Suite account. If they are monitoring me, is it visible? Is there any way ...
user avatar
3 votes
2 answers
9k views

Google Chrome and Certificate Problem

When I try to connect google.com and youtube.com with Chrome, I got the error below; 1. 2. Your connection is not private Attackers might be trying to steal your information from www.google.com.tr ...
Oray's user avatar
  • 131
2 votes
2 answers
469 views

Suspicious "ChromeSync" pop-up in Android requesting credentials

Since late May, I have been getting suspicious pop-up messages overlay on top of android Apps (see screenshots), requesting entering of the "ChromeSync Passphrase" for my google account. I ...
Travis Madson's user avatar
2 votes
2 answers
628 views

How Google protects and syncs the passwords?

I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
John's user avatar
  • 21
2 votes
0 answers
266 views

What is the threat-model of a malicious browser-extension accessing the data of *another browser-extension* that is security-critical?

Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" ...
ELLIOTTCABLE's user avatar
2 votes
0 answers
199 views

Does it matter that my browser shows an out-of-date certificate when a website uses service workers?

A website I frequent (a Discourse forum) uses Let's Encrypt TLS certificates which are updated every two months with a valid period of three months. But the certificate information shown by Chrome ...
curiousdannii's user avatar
2 votes
0 answers
2k views

Does Chrome cache smartcard PIN?

When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
ansonl's user avatar
  • 131
2 votes
0 answers
516 views

HTML Injection on iOS?

I had an uncommon issue with both Safari and Chrome on an iPhone 6 running iOS 9.0.1 last night - a number of sites were displayed with altered links and/or additional links (clearly from a third-...
pw_v's user avatar
  • 131
1 vote
0 answers
800 views

Recovering Chrome Passwords from Login Data File, Without Local State File

I ran the ForensIT profile migration wizard which migrates an existing profile to a new environment (from domain to workgroup, or vice versa). Doing so deletes encryption keys from Chrome's "...
junioradams's user avatar
1 vote
0 answers
190 views

Chrome with QUIC enabled is making TLS connection to first Google search result

When I search a site by its name on Google search engine, my Chrome browser pings the first search result, making a TLS connection. For example, if I search "github" on Google, the first ...
Marco Marsala's user avatar
1 vote
0 answers
217 views

Is it possible to use an ed25519 security key with Google Chrome SSH applets?

After generating an OpenSSH EC key on a hardware security key: $ ssh-keygen -t ed25519-sk -C comment Is it possible to use this key with Google Chrome SSH applet or Mosh, in particular on non-Linux ...
Petr's user avatar
  • 517
1 vote
0 answers
162 views

How would you follow all JavaScript calls after a click?

I'm using Google Chrome developer tools. Let's say I'm performing a bug bounty activity. I found an obfuscated JS. I know user data goes into this JS and goes out encrypted. I found a few files called ...
michel32's user avatar
1 vote
0 answers
233 views

Suspicious behavior by Google when verifying users via nodejs

I'm building a user authentication system in Nodejs and use a confirmation email to verify a new account is real. The user creates an account, which prompts him/her to check the email for a URL that ...
user avatar
1 vote
0 answers
160 views

does pasting a url into a chrome file upload dialog box (windows process) have security issues?

When using Chrome and I select a file for upload on a website that accepts files, a Windows dialog box appears for me to select a file. I can then paste a URL address for a file in the dialog box, ...
laughing muppet's user avatar
1 vote
0 answers
127 views

WMI Performance Adapter function for Chrome browser?

Does someone know why the WMI Performance Adapter (WmiApSrv.exe) always starts when launching Chrome browser? Whats the function of this service? I have heared this service can be maliciously used to ...
johnsmiththelird's user avatar
1 vote
0 answers
295 views

Bizarre request being made from Chrome

I've been seeing a very weird request being made from my Chrome browser (haven't noticed it on Brave). It does not run on all websites, and not all the time (it can appear on a website, then after a ...
capG's user avatar
  • 11
1 vote
0 answers
259 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
dsignr's user avatar
  • 111
1 vote
0 answers
91 views

Is it possible to open Chrome's databases.db in another MacBook?

According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
user188821's user avatar
1 vote
0 answers
173 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
R S's user avatar
  • 225
1 vote
0 answers
827 views

Bypassing the minimum size limit of a popup window in Chrome?

Recently I have come across several popup windows in chrome that somehow bypass the minimum height and width of a new window the browser usually imposes allowing them to hide mostly under the task bar,...
Lance Hardwick's user avatar
1 vote
0 answers
745 views

Is this 0-day RCE Exploit for Chrome fake?

I found this guy claiming that he has a 0-day Exploit for Chrome, Firefox and Windows 10, but to me it seems to be fake... Video - 0day RCE Exploit for Google Chrome 59.0.3071.86 Here is video for ...
user134969's user avatar
  • 1,338
1 vote
0 answers
3k views

ERR_SSL_PROTOCOL_ERROR on a site that doesn't use SSL/TLS, on an odd port

I've set up a server running Jenkins. The web-interface doesn't have SSL/TLS support turned on by default, and I have not attempted to turn it on, and do not want to turn it on (for now at least). ...
Savara's user avatar
  • 490
1 vote
0 answers
236 views

Have there been any known "in the wild" exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
user1258361's user avatar
1 vote
0 answers
150 views

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...
pinhead's user avatar
  • 171
1 vote
0 answers
2k views

Google Chrome Crash Report Analysis

I am new to the field of crash analysis. I recently, by accident, happened to crash Google Chrome. I do not know the reason as to why the crash really happened. I'd like to know it in depth though. ...
qre0ct's user avatar
  • 1,522
1 vote
1 answer
318 views

Can Chromebooks be affected by malware from an SD Card?

I've got an SD card that I think might contain infected files. However, those files are from my Windows days. I hear that Chrome OS is pretty hardy, and that it's really only posisble to get damage ...
Ocas's user avatar
  • 11
0 votes
0 answers
516 views

Tried 3 things to make Chrome accept remote self-signed SSL cert

I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ...
HerrimanCoder's user avatar
0 votes
0 answers
104 views

ARP Spoofing succeeded only partially

I have done arp spoofing to my phone using scapy and detected duplicate ips in the arp protocol with wireshark. However, access to websites using chrome app was blocked, but youtube and onedrive apps ...
kunokouki's user avatar
0 votes
0 answers
2k views

Searching in Chrome redirects to "find.fnavigate-now.com"

It used to do a Google search. Now it redirects to this weird website, which itself redirects to Yahoo. What gives? https://find.fnavigate-now.com/results.aspx?q=test&gd=SY1004294&searchsource=...
fnavigate's user avatar
0 votes
0 answers
164 views

When I visit an http://gofile.me/ link, how much information to I provide to the NAS server owner?

There are files I need from a heavy NAS user and they've given me a link of the form http://gofile.me/xxxxx/xxxxxxxxx If my laptop running the Chrome browser in macOS is connected to the internet via ...
uhoh's user avatar
  • 1,409
0 votes
0 answers
301 views

Google says my password has been found in data breach. HIBP knows nothing about it. Which data breach was that?

I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that ...
dragi's user avatar
  • 101
0 votes
0 answers
109 views

Most Secure ways to to authorize clients on their devices that are remotely connected by (AnyDesk, TeamViewer, etc...) without knowing the password

My case is I'm designing an app based on chromium browser powered by Electron . And I need sometimes to log the clients in with some web apps. The password is only visible as dots in browsers by ...
a.badawi's user avatar
0 votes
0 answers
162 views

Sending meaningless Addresses requests to a series of malicious IPs

i was testing somethings on browsers(It has nothing to do with what I am going to say) and accidentally i faced a case that when i browse meaningless addresses like abc/ signortest/ word/ the request ...
Signor's user avatar
  • 101
0 votes
0 answers
609 views

Global variables accessible to other websites opened in same tab

Today I found a security issue with Chrome (or maybe other browsers I haven't tested yet). What happens is that once you open a site and then open another site in the same tab, the previous site's ...
Aishwarya Shiva's user avatar
0 votes
0 answers
128 views

Is quarantine threats absolutely necessary? Every time I do, all my Chrome tabs crash

I have been talking backwards and forwards with a MalwareByte support, because every time I run 'quarantine threats' all my Chrome tabs crash. This guy keeps asking me to switch Google sync off, and ...
Pépe Pepito Pepón's user avatar