Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

72
votes
7answers
11k views

What attacks are made possible by public release of my web history?

Assume that my internet history is made public (accidentally or on purpose). And this release is over 24 hours since the visits were made. Also assume that there aren't an embarrassing sites on ...
56
votes
1answer
4k views

Does a client certificate identify the owner to unrelated websites?

If I install a client certificate in my browser, which websites can see any information about this client certificate or the CA that issued it? I once visited an ssl diagnostic site that immediately ...
0
votes
1answer
51 views

Can Arbitrary Code Execution be done using CSS Injection?

As part of our class project, we are studying the attacks that could be done using CSS Injection. In our threat model, attacker can manipulate any CSS file on the server. If attacker replaces original ...
3
votes
0answers
63 views

Is Stylish safe to use again?

Stylish is/was a very popular extension for the Chrome and Firefox web browsers, which let users add custom styles to certain websites. I was using it myself, until a helpful fellow told me it was ...
-1
votes
2answers
79 views

Is it possible for my school to see the apps that I use?

So I've seen that they can see stuff if you search it on Google, Bing, etc., but can they see the apps on my phone like Snapchat, Instagram, etc.? If so, can they see me using them?
0
votes
0answers
25 views

Work WiFi - privacy [duplicate]

If I browse using my mobile data on and then I go into work and my iPhone automatically connects to their WiFi, can they see my previous history or only stuff I’ve accessed while on the internet ...
67
votes
10answers
16k views

Why is JavaScript “safe” to run in the browser?

JavaScript has certain limitations such as preventing reading and writing to disk and not allowing access to other browser windows or domains. But is that all that's needed to prevent malicious code ...
0
votes
1answer
34 views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
0
votes
0answers
43 views

Too Much Information Exposure in OAuth 2.0?

Section 4.1 of the OAuth 2.0 RFC states: (A) The client initiates the flow by directing the resource owner's user-agent to the authorization endpoint. The client includes its ...
0
votes
2answers
25 views

SSL session key usage when browser opens multiple sockets to same server

Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same ...
0
votes
1answer
26 views

Displaying username in profile section of a Web Application

Is it a good idea to display the username in the user profile section of a web application, when the user is already logged in? My web application uses basic authentication and does not have any 2 ...
3
votes
1answer
66 views

Why does not Referer header use “same-origin” by default?

Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-...
0
votes
1answer
60 views

Inject JavaScript code into websites requested by an Android app? [closed]

How can I add custom scripts to pages I'm opening on Android via Chrome, Firefox or any other internet browsing app?
4
votes
1answer
117 views

Is information still being sent from a discarded tab in my browser?

I was connected to my workplace wifi via my personal phone for 10 minutes. I did not open anything strange that could get me into trouble. I was doing some work. However, when I finished looking up ...
0
votes
1answer
81 views

Why are there no browser feature or extension to only check the domain and username to prevent phishing?

One of the recommendations to prevent phishing using look-alike domain names (like www.google.com.phishing.org or IDN homograph attacks) is to use a password manager or a physical security token like ...
3
votes
1answer
40 views

When I upload a file on browser, will the server know my file path or disk info?

I believe server can know my file name. What other info will browser tell the server? File path? Disk info?
13
votes
1answer
177 views

Are browser wrappers in software bad for users?

These days I see a lot of browser wrappers in software. For example: when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
2
votes
2answers
85 views

Do browsers XSS filters protect against DOM based XSS?

Many (but not all) browsers come with built in XSS protection that can be activated with a HTTP header: X-XSS-Protection: 1; mode=block As I understand it, it prevents reflected XSS attacks by ...
0
votes
2answers
76 views

Is chrome's prediction service for faster page loading vulnerable to attacks? is it safe to leave it on?

Chrome offers a "prediction service" for faster page loading. It might load some links on a page before you even click on them: Use a prediction service to load pages more quickly: Browsers use an ...
0
votes
2answers
107 views

Can employers log internet traffic of employees personal computers? [closed]

I have a suspicion that my employer is misusing their work monitoring and remote access software to check my online activity outside of work. I have the software installed on my personal machine as I ...
2
votes
0answers
76 views

How to extract browser login credentials from memory dump? [closed]

Does anyone know if there is a way to extract passwords for social networks like from a browser memory dump? I tried this tutorial without success. I used dumpit.exe tool to make a full dump of the ...
15
votes
3answers
4k views

Does incognito/private browsing prevent XSS attacks?

When starting an incognito/private browsing session, no cookies from other browsing profiles should exist. For example, if I am logged in to a site on my main browsing profile, then start a new ...
4
votes
1answer
390 views

Danger of browser extension without any permissions?

Assuming that an extension for Firefox or Chrome does not request any WebExtensions permission, what harm could this extension do? Or put another way: What (potentially malicious) actions can an ...
0
votes
3answers
71 views

Determine All Possible Fields in HTML Form

Is it possible to determine, from the client-side, all the valid fields for a given backend form processor, even if they are excluded from the webpage containing the form? For example: Assume a ...
83
votes
5answers
20k views

Can “Accept cookie” button in a website be malicious?

I don't remember when this "accept/cancel cookie" button started to be used in websites. Why do they insist on getting users to click on this button? Can it do any harm to user's PC or to collect ...
-2
votes
1answer
78 views

Are schools over protective? [closed]

My school says that they can see their students history, but is it possible for them to do so even though you are using your own device?
2
votes
1answer
62 views

Can my VPN provider see my browsing activities on SSL sites? [duplicate]

I gather they can probably see everything if they want to on non-SSL sites but how about on SSL sites, can they do it?
0
votes
0answers
130 views

Something is visiting every URL after I do. What is it?

For each time I visit a unique URL on my web server, a mostly random Amazon owned IP address visits that URL fairly soon after. If I have a query string, and I use the same one that it's already ...
-1
votes
1answer
42 views

Infection of malware

Lets say, My firewall is configured to block any incoming connections My browser doesnt allow any traces and scripts I have vpn on My browser always asks before downloading files My browser doesn't ...
2
votes
2answers
210 views

Is single-click phishing possible?

For Chrome, IE/Edge, Safari, Firefox, Opera released after 2018, is it possible for a phishing to succeed by just enticing a user to click a URL? Notice: The user only does a click on the URL, no ...
1
vote
2answers
138 views

Is it secure to interact with a web page before it has fully loaded?

Web pages are often displayed in the browser before they have finished fully loading (i.e. the loading indicator is still spinning, etc). Usually this is caused by a slow advert or a video, etc. But ...
1
vote
0answers
79 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
3
votes
1answer
121 views

Invalid certificate name on go,microsoft.com

About 1 times out of 20, going to go.microsoft.com displays this page: The certificate is for www.holidaycheck.de which doesn't make sense. (Note: I'm Canadian, not Deutsch.) The other 19 times, I ...
3
votes
3answers
274 views

Security benefits of disabling Chrome Incognito mode?

The company I work for has disabled Incognito mode for Chrome (but allows InPrivate windows for Edge) and when I enquired why, I was told it was for security reasons. As a developer, I find Incognito ...
33
votes
8answers
12k views

Why should browser security be prioritized?

From this answer about browser security: time to update if you really care about security So if every other software and functions I need can work on a 32-bit OS, I guess the only reason for ...
1
vote
2answers
117 views

Why IPv6 showing on whatismyip.com?

I use Tor Browser on Whonix. Why I see IPv6 (something like 3221:23f9:c:67h:0:0:0:3) on whatismyip.com? Is that website can see my MAC Address?
2
votes
1answer
63 views

Risks of letting the browser open local/network file system listing

Browsers do not generally allow web pages to interact with client-side file system as a security measure. I would like to know what can go wrong with the following scenario: Clicking a special ...
2
votes
1answer
77 views

Is it possible for page to get your installed extensions through javascript?

When you visit a page, could that page tell what extensions you are running if javascript is enabled? If so then could we stop them or at least make it extremely difficult to increase our privacy?
31
votes
2answers
3k views

How does subresource integrity actually help?

Subresource integrity basically lets me know that a resource I'm about to download is valid, because the hash of its contents matches what I expect. But this assumes that I'm already running on some ...
2
votes
1answer
45 views

Why/how is browser inserting inline SVGs at end of body?

Chrome is inserting the following SVG images at the bottom of pages: <span style="width: 24px; height: 24px; background: url(&quot;data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/...
1
vote
1answer
71 views

Will a browser exploit also work after I have downloaded the website? [closed]

When I visit a website which exploits a vulnerability in my browser and I save this website to my computer and open later the offline version can my browser be hacked again?
3
votes
1answer
98 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
1
vote
1answer
166 views

Bad medical security

I reside in Michigan, U.S.A and just recently took over the IT of a small medical practice. There is no real security in place and I am still undoing the horrific damage and lockouts put in place by ...
64
votes
2answers
8k views

Are EU cookie consent forms safe? [closed]

Does the EU consent form system pose a new security risk? Today we have to click OK on about 20 cookie consent forms every week, where previously we could mostly dismiss internet forms as being ...
-3
votes
2answers
139 views

Do cookies violate privacy and should not be used? [duplicate]

Cookies are just a simple text file or DB (some parts encrypted). There is no way to execute them and they cannot access other user data store. Normally cookies keep some data like session ID or ...
2
votes
1answer
78 views

GET, “mailto” warning - how can I tell if a site is secure?

My password manager is giving me a warning when I go to certain sites. They say if I think I can trust the site to go ahead and use it .... this leaves me concerned I'll miss something. The pop-up ...
1
vote
3answers
211 views

How exploit this open redirect vulnerability in browser?

I have a problem. I found open redirect vulnerability by burp. Request by server look like here: GET /user/settings/ HTTP/1.1 Host: domain.com User-Agent: etc So i decided to find open redirect ...
1
vote
1answer
39 views

How do modern browsers isolate different addons?

A user may have multiple addons installed on a browser. But typically, the browser is running in userspace with an unprivileged uid. I was wondering how modern browsers can, in such a setting, provide ...
2
votes
2answers
76 views

Is RSA key-like browser authentication feasible?

I see that password based authentication is out of favor today, and Internet is moving toward RSA keys-based authentication. Coming from that fact, I am wondering if there would be a real benefit to ...
2
votes
1answer
141 views

Is there something similar to Firejail for OpenBSD?

On Linux, Firejail (https://firejail.wordpress.com/) offers an easy way to sandbox web browsers and other programs. Is there an easy way to sandbox a web browser on OpenBSD ? (reserve question: is ...