Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

2
votes
1answer
74 views

Is it safe to let the user name an object key in JavaScript?

Recently I found a piece of code that takes input from the url. The input then get's saved into a javascript object: https://website.com/?foo=bar var x = {"foo": "bar"}; While the value doesn't ...
0
votes
0answers
49 views

What “stability and security will suffer” by using a browser with the --no-sandbox flag?

Starting Brave browser (on linux manjaro) shows a “You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer.” message. Reading the support forums it seems that ...
5
votes
1answer
178 views
+50

Why were hyperlink auditing pings used for DDoS attacks and not any other requests?

A few days ago this new story has been published: Researchers have found that the HTML feature called hyperlink auditing, or pings, is being used to perform DDoS attacks against various sites. This ...
0
votes
0answers
48 views

Bypass input sanitization to close HTML comment for XSS injection [closed]

I'm trying to execute a XSS attack. But the content that reflected in the browser was commented out. So I tried to close the comment by including --> but this become - ->. (A space in - -.) I ...
-1
votes
0answers
38 views

How to implement Browser Isolation? [closed]

I just recently found out about Web Isolation. I also found about the many vendors offering it but I could not find an open source project doing so. So I want to start one. How could a solution like ...
64
votes
4answers
9k views

Is an up-to-date browser secure on an out-of-date OS?

Windows 7 support will end on January 14, 2020. Assuming that after that day I still use an updated browser, is it true that I'm still safe? Can it "patch" the OS-based security holes? Minor question:...
0
votes
0answers
37 views

Is JIT-compiler required for JIT-ROP attack?

I have been studying up on the concept of Just-in-Time (JIT) ROP attack (https://cs.unc.edu/~fabian/papers/oakland2013.pdf), and came across this question which I have not been able to find the ...
0
votes
1answer
77 views

How can Opera browser access my sessions on Google Chrome?

I just installed Opera browser v60 (i.e. Reborn 3) on Windows 10. I noticed that it has automatically (without my consent and permission) taken all my bookmarks in Google Chrome and added to the ...
3
votes
1answer
68 views

If the user agent contains information that could potentially be abused, why would every browser send it to every website?

As far as I've seen, every browser I use have a long User-Agent HTTP header that is as detailed as that it contains specific browser versions (or can be used to accurately deduce browser version, ...
11
votes
1answer
142 views

How do HTML5 DRM addons protect their output?

HTML5 has a DRM framework Encrypted Media Extensions (EME), that allows DRM companies to create content decryption modules (CDM) to decrypt DRM protected content. Browsers should use a sandbox to run ...
1
vote
0answers
47 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
1
vote
1answer
58 views

How to defend myself against potential malicious browser add-ons?

So previously I asked a question about what type of private data can addons extract from my browser : Can a malicious add-on access internet history and such in Chrome/Firefox? and it turns out if ...
0
votes
0answers
47 views

Embeddable 3rd party web tools security against stealing the key

We are building a website and we are using plenty of third-party tools that basically give you an HTML script tag and ask you to place it into your index.html. A few examples of such tools are: ...
0
votes
1answer
41 views

Session invalidation for 2 browsers

I have an app with the authentication using WSO2, using the scenario below: Login to the same apps with the same credentials in 2 different browsers (Chrome and FireFox) I change my password of my ...
18
votes
2answers
3k views

Can a malicious add-on access internet history and such in Chrome/Firefox?

How does Chrome/Firefox make sure add-ons are safe? Do they have any protection against a malicious add-on? How much access can add-ons have? Can they access internet history or maybe even cookies ...
0
votes
1answer
101 views

Why does Amazon verify a TLS certificate?

Show site information, then Connection for https://support.mozilla.org indicates Verified by: Amazon Why is this? Is Amazon spying on me?
0
votes
5answers
293 views

Is my Google Drive still secure if Chrome was heavily compromised?

I use an Apple eMac desktop computer. I formerly used Safari as my main browser. I migrated to Chrome as it is integrated with Google products. I use Google Drive very extensively as my main ...
2
votes
2answers
36 views

Insecure Direct Object Reference - Change email from client end

I am testing a website that has "Forgot my password" functionality. If user clicks that, his email address will be displayed as a hyperlink. If that is clicked, an email to reset password will be ...
0
votes
1answer
48 views

Virtualized or Container (Remote) Based Browser Isolation is more secure?

There obvious costs differences between them but I am not sure from a security perspective which of them considered to be more secure.
0
votes
1answer
68 views

Will browser isolation solution protect our enterprise from Flash and JavaScript exploits and fileless malware?

Since we didn't see any pentest done to bypass on such solution, we don't really know if it worth purchasing such type of solution. Will this really protect us from Flash and JavaScript exploits, ...
1
vote
0answers
17 views

Tor Browser 8.0.6 always turns on webgl.min_capability_mode [migrated]

I want to enable webgl in the Tor Browser 8.0.6. In about:config, all settings are saved except webgl.min_capability_mode, which is always set to true. Whatever I do, this value is always set true. ...
0
votes
0answers
70 views

What prevents a third party to use public API keys

In many cases, I have to add a public API key to my website (or application). For instance, in order to have an embedded map on a website, one could use google maps, and be required to provide an API ...
1
vote
0answers
35 views

Redirection to a blank page after searching on Google with the search bar of Firefox

Today I tried to use the search bar in the top-right side of Firefox (ver 65.0 64-bit on Linux Mint 18.3 Sylvia 64-bit), and the search bar contains "search Google in Traditional Chinese". When I use ...
51
votes
2answers
12k views

Is this Paypal Github SDK reference really a dangerous site?

I'm working on integrating a payment system with paypal in C#, and I installed the official paypal nuget package. Then I went to the paypal github site. And linked to this below site (SDK Reference). ...
0
votes
0answers
29 views

Are there any security implications to leaving Firefox's advanced developer tools enabled?

Mozilla's Firefox web browser has two advanced developer tools settings that are disabled by default. To enable them, open the Developer Tools settings, go to the section "Advanced Settings", and ...
0
votes
1answer
196 views

Random Chrome Notifications and Strange Source Code

My elderly parents are receiving chrome notifications from a strange URL on their iMac: (https://s1.snc.com.ru:443) Example Messages • Pending Payment: Paypal Has Sent You $65,900 • Clean your mac....
1
vote
0answers
45 views

How to determine if a website has been hijacked?

I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL. I was surprised by this change, ...
0
votes
1answer
48 views

Would cookie always change when browser changes?

I have been told that when the browser changes, the cookie will also change. If a user uses same machine, same IP, but different browser, is there any case that the cookie could stay the same? Or it'...
1
vote
2answers
56 views

3rd Party trackers and online privacy

I don't feel the internet is respecting our individual right to privacy. Why are 3rd party trackers allowed to siphon data from us without our permission? We should selectively be able to reveal what ...
2
votes
0answers
58 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
0
votes
1answer
54 views

Custom JavaScript injection allowed in DOM of other origins [closed]

I am performing a security research on a development framework for thick client & mobile applications. The framework allows developers to inject custom JavaScript in the DOM of any origin. This ...
0
votes
0answers
37 views

Javascript code instead of requested page

I am trying to access a third party website. For one of the requests, the browser displays some source code instead of rendering the response. Does this come under security issue? The source code has ...
0
votes
1answer
119 views

What is the protocol used for authentication/authorization of my internet access using account inside web browser?

Our university uses Microtik devices and a 3rd party application to manage our access to web and internet services. When I open browser in my desktop or connect to a wi-fi access point, it prompt that ...
2
votes
2answers
120 views

Are some privacy add-ons superfluous when using Tor browser?

If running the Tor browser, should you still have the same privacy add-ons as you would if you were running a "regular" browser? Or will some of them be superfluous because of the built-in ...
1
vote
1answer
53 views

Understanding which privacy tools provide very similar functionality

https://amiunique.org/tools has a list of recommended privacy tools. uBlock Ghostery HTTPS Everywhere Lightbeam AdBlock Plus Disconnect Privacy Badger NoScript Self-destructing cookies However, aren'...
2
votes
1answer
112 views

Opera browser: no master password?

I've recently moved from Firefox to Opera (for performance issues). I used to protect my passwords in Firefox with a Master Password. But Opera, so it appears, lacks such feature. I use Debian 9.7 ...
0
votes
1answer
129 views

What's the security concern of browsers using the HTTP CONNECT method?

The XMLHttpRequest spec says that attempted usage of the CONNECT method should throw a security error. Is there a security issue with client-side JavaScript sending CONNECT requests to servers? It ...
0
votes
0answers
42 views

How to check if installed Trusted CAs are not dangerous? [duplicate]

I've checked my Windows 7 installed Trusted Certificate Authorities using MMC tool as below: Questions are: How can I be sure that they are genuine and are installed by Microsoft and not by a third-...
1
vote
1answer
80 views

How to verify website owner behind CloudFlare SSL?

I went to Bittrex today and noticed the SSL certificate is issued to CloudFlare, not Bittrex, as seen in the screenshot below. I'm used to seeing information on this screen which can be recognized as ...
0
votes
0answers
30 views

What information can be obtained with my public ip? [duplicate]

As I understand it, my public ip is known for everyone who communicates with me over the internet. I'm concerned about security, and my doubt is, what can a malicious agent find out about me by ...
6
votes
2answers
136 views

Can a web app fingerprint your device as identical to a native app's fingeprint

I have installed an app on Android and my account got shadowbanned. I sniffed out the traffic with fiddler and see they use a analytics service that assigns your device a fingerprint. I tried the web ...
0
votes
1answer
112 views

Smart cards and the behaviour of the browser. Is the PIN cached?

When using smart cards for certificate-based authentication, is the PIN entered by the user to authenticate his smart card to the browser is cached? OR does the certificate gets cached by the browser? ...
2
votes
0answers
28 views

Collecting PII in an iframe on any website. Is it Safe?

I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
0
votes
1answer
80 views

Can an attacker steal information from my HTTPS page by embedding it?

If a login page, secured with https/tls redirects to another site (also secured with https/tls) with a onetime use token (expires in a minute and has a nonce) in the querystring, can this token be ...
1
vote
0answers
46 views

Privacy & tracking concerns regarding Service Workers

TL;DR Should I be concerned about sites I have visited start a service worker in my browser which happens to be listening for events "forever"? Can a dormant service worker track me? Longer ...
0
votes
0answers
33 views

Clickjacking when essential JavaScript code accesses attribute of 'top'?

Given a website which doesn't use any protection specifically against Clickjacking (no X-Frame-Options or CSP), but which does access an attribute of top in essential JavaScript code, eg: // http://...
0
votes
1answer
212 views

CSP - Unsafe-inline or unsafe-eval for specific domain is allowed or not

Following is a CSP policy, for example derived sample response headers. The implementation below allows white-listed domains only in "script-src" directive but the 'unsafe-inline' and 'unsafe-eval' ...
2
votes
1answer
53 views

Does MathML pose a security risk?

MathML seems like a promising and attractive technology. But Google Chrome doesn't support it, allegedly because it has "architectural security issues" according this wikipedia page. But it also says "...
3
votes
2answers
142 views

How can a client verify that code sent from the server has not been tampered with?

While trying to understand the recent controversy involving ProtonMail, I started to wonder if its possible to verify that the opensource JavaScript being sent from the server to the client hasn't ...
0
votes
1answer
235 views

SameSite cookie attribute and Synchronizer Token Pattern

Recently most browser have added support to the SameSite cookie attribute to prevent CSRF attacks: https://www.owasp.org/index.php/SameSite Question if it is supported should we implement ...