Questions tagged [chrome]
Popular web browser by Google, see chrome.google.com for more information.
56 questions with no upvoted or accepted answers
5
votes
0
answers
696
views
Can Chrome extensions access other Chrome extensions' data?
Can the data in a password-manager Chrome extension be accessed by a different Chrome extension? For example, if one were to install a malicious extension, could that extension access the data (i.e., ...
- 51
4
votes
0
answers
323
views
How does Google Chrome's "Warn you if passwords are exposed in a data breach" feature work?
This feature is enabled by default. It says the usernames and passwords would be encrypted before sending to google. But google would know the encryption keys it used and to compare it with leaked ...
- 41
4
votes
0
answers
286
views
What are the potential vulnerabilities with containerized rootless Chrome and --no-sandbox?
I'm evaluating running Chromium without native sandboxing in a rootless container. A few points:
You can containerize Chrome using rootless containers with something like podman. This will utilize ...
- 3,107
4
votes
0
answers
1k
views
How does Chrome's Renderer Code Integrity Protection Work?
I recently heard of Chrome's Renderer Code Integrity Protection, which is apparently supposed to prevent unsigned dlls from being loaded into the chrome.exe process, and figured I'd test what would ...
- 41
4
votes
2
answers
858
views
Malware techiques via Linux Chrome and its effects, non-root
Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
4
votes
1
answer
12k
views
Why did Chrome show my connection to Youtube as not secure?
I was browsing on Youtube a while ago, when I noticed that Chrome showed it as an insecure connection even though it was over HTTPS.
I'm using Ghostery and Adblock to block trackers but nothing more, ...
- 41
3
votes
0
answers
159
views
Can a website on Google Chrome know whether the user actively using the computer?
If I have opened a website in Google Chrome on Windows 10 and it runs in the background, can it spy to see whether I'm actively interacting my computer or the computer runs without any user ...
- 1,956
3
votes
1
answer
748
views
What is this URL that loads each time Google Chrome spawns?
What does this URL do that opens each time Google Chrome loads?
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOWVmQUFXS041NV9ZVXlJVWwxbGc5TUM4dw/7519.422.0....
- 31
3
votes
0
answers
364
views
How/When does Chrome queries Certificate Transparency (CT) log servers to ask for inclusion proof of certificates and how can I debug them?
I’ve been trying to understand how does Chrome interact with CT log servers. According to what I’ve read so far, Chrome sends inclusion proof requests (“GET https:///ct/v2/get-proof-by-hash” - https://...
- 31
3
votes
0
answers
848
views
HTML link with "noopener" and/or "noreferrer" in Chrome/Chromium results in unexpected behaviour
There are several attacks possible when embedding links with target="_blank". This is where rel="noopener" and rel="noreferrer" should help.
I am expecting that clicking the following link
<a ...
- 131
3
votes
0
answers
171
views
Mechanisms of built-in password managers in browser
I am researching for auto-fill mechanisms in built-in web-browsers password managers.
Using windows hosts file i am redirecting browser query to my web-server where i am storing the full copy of ...
3
votes
0
answers
6k
views
Does this list every Chrome extension/addin that may leak privacy?
I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party.
To that end, I discovered: chrome://net-...
- 51.1k
3
votes
1
answer
1k
views
Can my G Suite admin see my browsing history if: I am in incognito mode on iPad Chrome?
Can my G suite admin see by browsing history if: I am in incognito mode on iPad Chrome?
iPadOS beta 3.
I'm signed in with a G Suite account.
If they are monitoring me, is it visible? Is there any way ...
user211747
3
votes
2
answers
9k
views
Google Chrome and Certificate Problem
When I try to connect google.com and youtube.com with Chrome, I got the error below;
1.
2.
Your connection is not private
Attackers might be trying to steal your information from www.google.com.tr ...
- 131
2
votes
2
answers
577
views
Suspicious "ChromeSync" pop-up in Android requesting credentials
Since late May, I have been getting suspicious pop-up messages overlay on top of android Apps (see screenshots), requesting entering of the "ChromeSync Passphrase" for my google account.
I ...
2
votes
2
answers
777
views
How Google protects and syncs the passwords?
I read this post but I want to know more details. I know that Google uses a Windows' function called CryptProtectData to encrypt user passwords on Windows and Google only stores the encrypted forms of ...
- 21
2
votes
0
answers
282
views
What is the threat-model of a malicious browser-extension accessing the data of *another browser-extension* that is security-critical?
Modern password-managers are moving towards a "fully-in-the-browser" model (see: historical RCE on LastPass, and now 1Password is also moving towards 1Password X as "the future" ...
- 285
2
votes
0
answers
209
views
Does it matter that my browser shows an out-of-date certificate when a website uses service workers?
A website I frequent (a Discourse forum) uses Let's Encrypt TLS certificates which are updated every two months with a valid period of three months. But the certificate information shown by Chrome ...
- 371
2
votes
0
answers
321
views
Securing internal API credentials on a public chrome extension
I've developed a Chrome extension that I plan to publish to the Chrome Web Store.
On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
- 121
2
votes
0
answers
2k
views
Does Chrome cache smartcard PIN?
When I have authenticated with a server suing TLS/SSL using HTTPS using a smartcard and PIN and I invalidate the TLS session by restarting the server, refreshing Chrome browser does not reprompt for a ...
- 131
2
votes
0
answers
540
views
HTML Injection on iOS?
I had an uncommon issue with both Safari and Chrome on an iPhone 6 running iOS 9.0.1 last night - a number of sites were displayed with altered links and/or additional links (clearly from a third-...
- 131
1
vote
0
answers
79
views
Detecting drive-by-download attack on android
Context: I received a text message about unpaid ticket on the same day I parked at a hospital dropoff zone. The number was from an entirely different province and the url looked very odd. Not a number ...
1
vote
0
answers
991
views
Recovering Chrome Passwords from Login Data File, Without Local State File
I ran the ForensIT profile migration wizard which migrates an existing profile to a new environment (from domain to workgroup, or vice versa). Doing so deletes encryption keys from Chrome's "...
- 11
1
vote
0
answers
113
views
ARP Spoofing succeeded only partially
I have done arp spoofing to my phone using scapy and detected duplicate ips in the arp protocol with wireshark.
However, access to websites using chrome app was blocked, but youtube and onedrive apps ...
- 11
1
vote
0
answers
224
views
Chrome with QUIC enabled is making TLS connection to first Google search result
When I search a site by its name on Google search engine, my Chrome browser pings the first search result, making a TLS connection.
For example, if I search "github" on Google, the first ...
- 333
1
vote
0
answers
243
views
Is it possible to use an ed25519 security key with Google Chrome SSH applets?
After generating an OpenSSH EC key on a hardware security key:
$ ssh-keygen -t ed25519-sk -C comment
Is it possible to use this key with Google Chrome SSH applet or Mosh, in particular on non-Linux ...
- 537
1
vote
0
answers
167
views
How would you follow all JavaScript calls after a click?
I'm using Google Chrome developer tools.
Let's say I'm performing a bug bounty activity.
I found an obfuscated JS. I know user data goes into this JS and goes out encrypted.
I found a few files called ...
- 11
1
vote
0
answers
237
views
Suspicious behavior by Google when verifying users via nodejs
I'm building a user authentication system in Nodejs and use a confirmation email to verify a new account is real.
The user creates an account, which prompts him/her to check the email for a URL that ...
user237854
1
vote
0
answers
168
views
does pasting a url into a chrome file upload dialog box (windows process) have security issues?
When using Chrome and I select a file for upload on a website that accepts files, a Windows dialog box appears for me to select a file.
I can then paste a URL address for a file in the dialog box, ...
1
vote
0
answers
137
views
WMI Performance Adapter function for Chrome browser?
Does someone know why the WMI Performance Adapter (WmiApSrv.exe) always starts when launching Chrome browser? Whats the function of this service?
I have heared this service can be maliciously used to ...
- 493
1
vote
0
answers
296
views
Bizarre request being made from Chrome
I've been seeing a very weird request being made from my Chrome browser (haven't noticed it on Brave). It does not run on all websites, and not all the time (it can appear on a website, then after a ...
- 11
1
vote
0
answers
95
views
Is it possible to open Chrome's databases.db in another MacBook?
According to this post, Chrome passwords are stored in /Users/$USER/Library/Application Support/Google/Chrome/Default/databases/Databases.db. Is it possible for an attacker to copy Chrome passwords ...
- 11
1
vote
0
answers
177
views
What is the essence of Google Chrome’s new controversial sign-in feature?
What is the essence of Google Chrome’s new controversial sign-in feature?
How does it work and how does it differ from what was it before?
What is the danger of it?
Is Chromium affected?
- 225
1
vote
0
answers
859
views
Bypassing the minimum size limit of a popup window in Chrome?
Recently I have come across several popup windows in chrome that somehow bypass the minimum height and width of a new window the browser usually imposes allowing them to hide mostly under the task bar,...
1
vote
0
answers
749
views
Is this 0-day RCE Exploit for Chrome fake?
I found this guy claiming that he has a 0-day Exploit for Chrome, Firefox and Windows 10, but to me it seems to be fake...
Video - 0day RCE Exploit for Google Chrome 59.0.3071.86
Here is video for ...
- 1,338
1
vote
0
answers
3k
views
ERR_SSL_PROTOCOL_ERROR on a site that doesn't use SSL/TLS, on an odd port
I've set up a server running Jenkins. The web-interface doesn't have SSL/TLS support turned on by default, and I have not attempted to turn it on, and do not want to turn it on (for now at least).
...
- 490
1
vote
0
answers
239
views
Have there been any known "in the wild" exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?
https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html
I looked for any news about them and couldn't find anything. Anyone ...
- 420
1
vote
0
answers
155
views
Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?
My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use.
Portable Chromium is ...
- 171
1
vote
0
answers
2k
views
Google Chrome Crash Report Analysis
I am new to the field of crash analysis. I recently, by accident, happened to crash Google Chrome. I do not know the reason as to why the crash really happened. I'd like to know it in depth though.
...
- 1,522
1
vote
1
answer
337
views
Can Chromebooks be affected by malware from an SD Card?
I've got an SD card that I think might contain infected files. However, those files are from my Windows days. I hear that Chrome OS is pretty hardy, and that it's really only posisble to get damage ...
- 11
0
votes
0
answers
575
views
Tried 3 things to make Chrome accept remote self-signed SSL cert
I have a sandbox Windows 2016 server in the cloud that only I use for dev, testing, and experimentation. I can access the site remotely from Chrome, but no matter what I try, Chrome displays the ...
- 101
0
votes
0
answers
2k
views
Searching in Chrome redirects to "find.fnavigate-now.com"
It used to do a Google search. Now it redirects to this weird website, which itself redirects to Yahoo. What gives?
https://find.fnavigate-now.com/results.aspx?q=test&gd=SY1004294&searchsource=...
- 13
0
votes
0
answers
239
views
When I visit an http://gofile.me/ link, how much information to I provide to the NAS server owner?
There are files I need from a heavy NAS user and they've given me a link of the form http://gofile.me/xxxxx/xxxxxxxxx If my laptop running the Chrome browser in macOS is connected to the internet via ...
- 1,409
0
votes
0
answers
325
views
Google says my password has been found in data breach. HIBP knows nothing about it. Which data breach was that?
I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that ...
- 101
0
votes
0
answers
114
views
Most Secure ways to to authorize clients on their devices that are remotely connected by (AnyDesk, TeamViewer, etc...) without knowing the password
My case is I'm designing an app based on chromium browser powered by Electron .
And I need sometimes to log the clients in with some web apps. The password is only visible as dots in browsers by ...
- 1
0
votes
0
answers
178
views
Sending meaningless Addresses requests to a series of malicious IPs
i was testing somethings on browsers(It has nothing to do with what I am going to say) and accidentally i faced a case that when i browse meaningless addresses like abc/ signortest/ word/
the request ...
- 101
0
votes
0
answers
677
views
Global variables accessible to other websites opened in same tab
Today I found a security issue with Chrome (or maybe other browsers I haven't tested yet).
What happens is that once you open a site and then open another site in the same tab, the previous site's ...
- 121
0
votes
0
answers
132
views
Is quarantine threats absolutely necessary? Every time I do, all my Chrome tabs crash
I have been talking backwards and forwards with a MalwareByte support, because every time I run 'quarantine threats' all my Chrome tabs crash. This guy keeps asking me to switch Google sync off, and ...
0
votes
0
answers
482
views
Is Chrome Browser/ Computer compromised by KMSPico?
I recently installed a new windows key for my friend.
He was using a hack program previously, known as Auto KMS. So after new keys installation, I used Windows defender to remove AutoKMS program. The ...
- 101
0
votes
0
answers
489
views
Unable to intercept traffic on android application using burp suite
When I try to intercept the traffic through burp suite, the app itself won't load. This doesn't happen in some applications like Chrome and Gmail but happens on YouTube and other applications. It ...
- 1