Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

Filter by
Sorted by
Tagged with
1
vote
1answer
45 views

Can a program log your browser activity with taskbar names?

There's this old reddit thread where the OP notes that Discord's desktop client regularly logs the processes on your computer using QueryNameInformationFile, then claims that Discord "proceeds to ...
3
votes
1answer
42 views

Is it better to disable X-XSS-Protection header or set the header as X-XSS-Protection: 0?

Because X-XSS-Protection header is now not supported by major browsers I wonder what option is better, to delete this header or to set the header as X-XSS-Protection: 0? Because browsers do not ...
1
vote
0answers
21 views

Is checking to see if any parameters contain “__proto___” an effective way to mitigate Prototype Pollution vulnerability?

let key = keys[j] === '' ? (currentParams as any).length : keys[j]; if (key === '__proto__') { throw new Error('Prototype pollution detected.'); } It at least defeats basic url-encoding,...
3
votes
2answers
246 views

A runtime sometimes converts string arguments (or string returns) from WTF-16 to UTF-16 between functions in a call stack. Is this a security concern?

Suppose that we have this code (in TypeScript syntax): function one(str: string): string { // do something with the string return str } function two() { let s = getSomeString() // returns some ...
0
votes
0answers
26 views

Does NW.js send “crash reports” to Google (or anyone external) by default? [migrated]

https://nwjs.readthedocs.io/en/latest/References/Manifest%20Format/ crash_report_url Once the app crashed, the crash dump file and information about the runtime environment will be sent to the crash ...
0
votes
2answers
202 views

Why are web browsers insecure?

Currently in the news is yet another hack, this time from NSO and it is reported that an attack vector is via a web link. This is far from unique, as we have got used to advice to not click on "...
0
votes
1answer
95 views

What are the risks when using proxy such as Fiddler

I would like to understand a point. When I use fiddler it creates a local proxy to analyze the traffic, so far everything is fine. However when Fiddler is launched and I browse an HTTPS site the ...
0
votes
0answers
41 views

Can't set master password in the tor browser [migrated]

I'm using the tor browser Version 78.11.0esr in whonix 15, everything works, except that I cannot save logins in the tor browser because every time I try to setup a master password, a popup window ...
0
votes
0answers
22 views

Why does Firefox claim a site has a “Potential Security Risk”? [duplicate]

When trying to go to https://www.pfizerpapconnect.com, the Firefox web browser claims there is a "Potential Security Risk" and pops up a page recommending to not proceed. Is there a real ...
1
vote
1answer
71 views

How could I know if a website is fingerprinting you via WebGL?

I would like to know if a website is fingerprinting me via WebGL, first of all, knowing if the site is doing it Knowing when they send the request to my browser Knowing what value I am reporting to ...
0
votes
1answer
99 views

Is wiping cookies, blocking trackers and not logging in sufficient to prevent profiling?

I use Firefox as my browser. My privacy settings are strict. I block All third-party cookies, and always delete all cookies when Firefox is closed. Tracking content (in all windows); Cryptominers; ...
0
votes
1answer
35 views

Public Key Pinning Attack? [duplicate]

I'm somewhat knowledgeable in the concept of Public Key Pinning (HPKP) and I see a potential attack where a server admin could pin a particular cert and thus demanding user's browsers to only honour ...
0
votes
1answer
28 views

Does moving webAuthn API from browser to OS improves security of registration process?

Usually, for all types of authentications, we trust the registration process and assume there is no attack is happening Like in the case of FIDO2 registration. However, as the registration process is ...
5
votes
1answer
108 views

Is it safe to allow CSS filter: url(data:<SVG SOURCE HERE>)?

We have a web service where logged in users can create web page content and write custom CSS for their pages. All the HTML goes through a whitelist parser and doesn't allow any executable content. All ...
0
votes
0answers
37 views

How risky it is if a server allows client Javascript access to say an access token in header?

After authenticated by Google, a client browser attaches the idToken from Google to an application API server. Assuming google-auth-library auto-refresh an expired token, it now needs to send it back ...
0
votes
1answer
107 views

What is the workflow from client to server for SSL enabled sites?

I have a basic question on workflow of SSL enabled sites from client browser to server. My understanding is when the browser has to access some https enabled site, the browser contacts some CAs. I am ...
1
vote
2answers
101 views

Browser fingerprint is unique while running a VM of a clean install of Windows 10

So I used Qemu on Ubuntu 20 to emulate a computer running windows 10. I kept all of Qemu default values. Then, while installing the Windows 10 iso, I kept all the default values once again. Finally, I ...
0
votes
0answers
49 views

Ad popups showing on personal website deployed on VPS

I have a Spring-MVC webapp deployed on a Hostinger VPS server (OS: Ubuntu 18.04, Apache2 + Tomcat servers). For some reason, every now and then, clicking on random regions within the web pages of my ...
0
votes
3answers
71 views

On what types of web content is a Content-Security-Policy useful?

The W3C spec for Content-Security-Policy or Mozilla CSP docs would be the definitive source for this answer, but it does not seem covered, so I'm asking here for answers based on people's experience. ...
0
votes
2answers
125 views

How does a browser stop malware from executing? [duplicate]

When it comes to infections with viruses, in almost all cases the initial infection requires some sort of user interaction - apart from those cases where a plug-in has some sort of security flaw which ...
1
vote
1answer
135 views

Is it still possible to get a virus simply by visiting a website? [closed]

I know this is a duplicate question, but there aren't any recent updates on the answers given to this question(here and here) and after a few years, I'm sure browser security has improved drastically. ...
6
votes
2answers
222 views

Simple way to safely paste text from website into terminal

It's fairly well known that it's very dangerous to copy-paste text from a website into a terminal, as it can include extra text, control codes, and newlines that aren't visible when you're copying it, ...
0
votes
1answer
82 views

Identifying unique visitor using only info that can be gathered through the browser?

There is a site that allows a voter to vote for their favorite nominee once a day for a certain amount of days. While entering a vote, the only info given is the ballot choice you choose and nothing ...
0
votes
1answer
76 views

Is every plain flow into a dangerous sink exploitable?

Given a flow of information (for example from the URL) into a sink on a certain site, and given that this information is plain, i.e. is not sanitized, does this mean that if an attacker could control ...
0
votes
0answers
70 views

Sending meaningless Addresses requests to a series of malicious IPs

i was testing somethings on browsers(It has nothing to do with what I am going to say) and accidentally i faced a case that when i browse meaningless addresses like abc/ signortest/ word/ the request ...
0
votes
3answers
103 views

Can a compromized browser know your ISP's IP even if using a VPN?

Let's say you use a reliable VPN like ProtonVPN to browse the Internet. In theory, can a compromized browser betray you? Does it has access to your ISP's IP? As a bigger picture, if you want to upload ...
5
votes
1answer
504 views

How did Firefox get my passwords?

I just installed Firefox browser, while I have previously used Google Chrome as my main browser. I am using Windows 10. During the installation and setup process for Firefox, I was given the option to ...
1
vote
1answer
93 views

How can I protect browser cached files to be accessed in a case of a stolen hard drive?

For the usual reasons we want to cache certain resources browser side, e.g. list of products bought in the past. Context is a web application, accessed via the internet. This list is confidential in ...
0
votes
1answer
137 views

Is ProtonMail implemented a mechanism to prevent cookies stealing?

I want to check if I can steal my own ProtonMail cookies. I connect to my account, I delete the cookie named AUTH-x12334xxxaazzzrf6567788ddd (cookie name is randomized name). I refresh the page and as ...
0
votes
0answers
102 views

Can Tor browser protect me from being found out? [duplicate]

I am using my computer, but am connected to my work's WiFi. Can my company see what websites I visit when am using Tor browser?
4
votes
3answers
835 views

Is Firefox's new JavaScript support within PDF files a security concern?

Historically, we have learned that many security vulnerabilities and exploits have resulted from allowing document files to contain executable code, whether it be JavaScript, VBScript, another ...
0
votes
1answer
62 views

How do applications which are integrated using a javascript client side sdk, secure their data or disallow spam?

Take an example of google maps. google maps provides a javascript client SDK, which means any web app running javascript can access the google maps sdk. You need to use an API_KEY so that google can ...
0
votes
0answers
81 views

XSS attack being blocked by the browser

I'm trying to validate / test and XSS attack; however when I navigate to the page, the browser (tried on Chrome and Edge) tells me: A parser-blocking, cross site (i.e. different eTLD+1) script, is ...
0
votes
2answers
715 views

Local IndexedDB in Browser - is it really a security risk?

We have a web application that stores cached information in browser (both is firefox and chrome). When we subjected it to Penetration Testing, a finding was filed saying that "Senstive Data such ...
1
vote
0answers
54 views

Facebook retargeting pixel

Given a commercial website buy.com and a user with a Facebook account in facebook.com, the user has third-party cookies disabled in the browser. If a user is logged in their Facebook account and ...
0
votes
1answer
57 views

Can display a GIF in <img> tag causing Client-side DOS

SVG image can be used in DOS user browser with billion laugh attack. Can we do the same with other image types? especially GIF? Thanks everyone.
0
votes
1answer
72 views

IMAP credentials in WEB (browser) app - how to use securely

I need to send and check email (via IMAP email servers) from my web app. Storing credentials on server seems like problem as they are almost always plain text. So if I store them in client browser's ...
2
votes
1answer
94 views

Is an XSS attack possible under these constraints?

The output is: <img src="http://example.com/[input]" oncontextmenu="openUrl('http://example.com/[input]')"> Where [input] is the user input, which is sanitised through this ...
0
votes
1answer
76 views

Google Chrome, the best bet for online privacy? [closed]

You may think I'm crazy, that's why I'm here to ask. I read this page which went over the privacy and security of many if not all browsers. From his reporting, and my own logic, that the government ...
0
votes
0answers
88 views

Global variables accessible to other websites opened in same tab

Today I found a security issue with Chrome (or maybe other browsers I haven't tested yet). What happens is that once you open a site and then open another site in the same tab, the previous site's ...
1
vote
0answers
40 views

Browser session storage

Is it some secure way to store private keys in session storage? or is there any place to store that info securely?
0
votes
0answers
122 views

Can a hacker hack my phone by not installing anything on my device?

I know that a device can be compromised by a drive-by download. But could an attacker access my device without installing any malicious app? Can he access my camera by just executing a malicious ...
0
votes
0answers
29 views

Can my school see my browsing history while on campus? [duplicate]

I'm a bit paranoid right now about what my school can and can't see on my device. My school has a BYOD policy which means that I bring my own device to work. I am logged in using my personal account ...
1
vote
0answers
123 views

Can someone turn my browser into a RDP with a keylogger? [closed]

I got an email the other day telling me that when I visited a website, someone installed malware in the website with which he was able to use my browser as an RDP. Kinda paranoid right now.
0
votes
1answer
190 views

Can you get virus from previewing email attachments in Gmail?

If an email attachment such as .docx, jpeg, .xls, .pdf, etc. contains virus/malware and if I open it for preview (not opening it in Google Docs or downloading it and opening it) then can I get ...
0
votes
1answer
98 views

Is there a way to check if my site visitor has visited another site?

I want to know if the current visitor has already visited a specific site. The site is owned by someone else and is on a different domain. Is there a way?
2
votes
1answer
64 views

What happens if multiple Strict-Transport-Security headers are set in the HTTP response?

If multiple Strict-Transport-Security headers are set with different settings (e.g. different max-age values), how will the browser behave? Does the browser just follow one of them, or simply error ...
0
votes
1answer
51 views

Storing Client Data for next page?

I have a little project for authentication and I need to store an encryption key on website B which I get from the server on website A, but the server from website B should not be able to read it. Is ...
0
votes
0answers
179 views

Get HLS decryption key from browser

How can I get decryption key for AES-128 encrypted HLS stream. In the m3u8 file, the URI for key leads to a file which is of 48 bytes which is encrypted. The stream is played by browser so it must ...
0
votes
0answers
54 views

Can I skip “if” statement with chrome debugger or another javascript debugger?

I see this code in a bug bounty program The code: <!DOCTYPE html> <html> ... </html> <script> if(window.location.pathname === '/' || window.location.pathname.includes('.html')){...

1
2 3 4 5
31