Questions tagged [web-browser]

A web browser is an application which uses HTTP and related protocols to retrieve HTML and XML data from servers. As the web has become a critical source of information and communication, web browsers have become a critical component in information request, transfer and management.

83 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
1answer
168 views

What is the proper terminology and base CVSS score for the following cache related behaviour?

An interface (website/application) that requires authentication should have a proper HTTP caching mechanism. When it doesn't, it allows an attacker to browse back after logout or read the cache in ...
4
votes
0answers
179 views

Desktop browser that supports Fido U2F over CCID

Is there any browser that supports Fido U2F over CCID for smart cards? As far as I can see Firefox and Chrome only support U2F over HID, and only Chrome for Android (with Google Authenticator2) ...
4
votes
0answers
2k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
4
votes
0answers
2k views

Is Cross Site History Manipulation (XSHM) still relevant?

XSHM is a vulnerability which exploits the fact that the browser history object does not follow the Same Origin Policy and hence by tracking the changes made to this object we may be able to track a ...
4
votes
0answers
257 views

Saved password store on Android Edge browser

Does anyone have knowledge, or better yet, a reference document showing how and where passwords are stored when using the Edge browser on Android? I'm assuming it's going to be SQLite, as I ...
3
votes
1answer
128 views

What mechanism does Firefox use to remember the in-session logins, after entering the Master Password?

After I have entered my Master Password, does Firefox decrypt all the logins and store them somewhere? Or does it store the Master Password itself? Is the in-session period (more) vulnerable to attack?...
3
votes
0answers
156 views

Sandboxing untrusted JavaScript execution by redeclaring variables

Some irrelevant background (read only if you want to say "no, just use an iframe") Scenario Suppose that I downloaded a string jsCode containing arbitrary JavaScript code from a (potentially ...
3
votes
0answers
63 views

Is it possible to “polyfill” a vulnerable Flash player to a users machine when they visit a web page?

This is about the concept of adding "necessary code" to a webpage to ensure that any client can view the "content" provided through that page. This sort of code is sometimes referred to as a polyfill. ...
3
votes
0answers
78 views

Switching connection encryption on the fly (browser padlock)

On Youtube, the connection is encrypted (green padlock). However I found myself in a situation that when I click on for example a comment that contains a URL to a different website (on which the ...
2
votes
0answers
66 views

Are there any JRE/JDK exploits that do not require the presence of applets or plugins?

For triggering a Java exploit should applets be enabled in the user's machine? That is, in a drive by download scenario, can just visiting a malicious URL trigger an exploit/cve on the user's pc due ...
2
votes
0answers
545 views

Is it still possible to use HTTP TRACE for XSS in modern Web Browsers?

Let's assume we are talking about top 10 most used web browsers: Usage share of web browsers https://www.cgisecurity.com/questions/httptrace.shtml 'TRACE' is a HTTP request method used for ...
2
votes
0answers
95 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
2
votes
0answers
52 views

Collecting PII in an iframe on any website. Is it Safe?

I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
2
votes
0answers
224 views

How does the Ruby on Rails CSRF Protection Work?

I am not sure i completely understand how Ruby on Rails handles CSRF protection. My understanding was that a token is generated and embedded in the HTML markup as a meta tag, and at the same time ...
2
votes
2answers
361 views

Malware techiques via Linux Chrome and its effects, non-root

Is it possible to visit a website with Chrome on Ubuntu and have that site execute shell code on my machine without explicitly downloading anything nor click on some Chrome execute question/popup? If ...
2
votes
0answers
1k views

“Opera:CrossNetworkWarning” What does it mean, why does it appear, and what are the dangers?

I am using the following browser with javascript and cookies disabled: Opera/9.80 (Windows NT 6.2; WOW64) Presto/2.12.388 Version/12.15 When I try to access Github just now, the following message ...
2
votes
0answers
1k views

Configuring Chrome to handle ETags like Safari

ETags can be used for tracking, but I happened to notice that Safari handles them differently from Chrome (and Firefox). I believe it's non-standard because it doesn't work across domains. If we ...
2
votes
0answers
471 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
2
votes
0answers
5k views

Does this list every Chrome extension/addin that may leak privacy?

I am looking for a simple list of all extensions, preference, custom processes, and "flags" that may disclose a user's privacy or other details to a 3rd party. To that end, I discovered: chrome://net-...
2
votes
0answers
585 views

Suggestions on how to capture network connections/traffic for determining browser/SSL versions?

I've started thinking about how to approach analyzing my network traffic for information relating to SSL and browser usage for my web server farm. I also suspect there are some shadow (legacy, unknown)...
2
votes
1answer
450 views

How can youtube track user in sandbox?

I used Chrome in Sandboxie, and even after deleted contents of the sandbox, youtube.com still recommended videos for me, which based on vids I saw. Only after I deleted all history in Chrome then ...
1
vote
0answers
34 views

What, if anything, are the consequences of temporarily enabling and then disabling WebRTC in Firefox?

For security and privacy purposes, it's best to keep WebRTC disabled if you aren't using it. Firefox makes this easy by simply setting media.peerconnection.enabled to false. Due to COVID-19, the use ...
1
vote
0answers
62 views

Why are DNS prefetch requests sent in clear text with DNS over HTTPS enabled?

I am trying to understand how DNS-over-HTTPS (DoH) works in both Chrome and Firefox browsers. To do so, I have enabled DoH on each browser and set the DNS provider to Cloudflare DNS servers (1.1.1.1 ...
1
vote
0answers
26 views

SSO and browser vs. server

We've got implementations in a browser-based system right now that does both SAML and OpenID-connect login support, but does them differently and was looking for advice on the risks. Our SAML ...
1
vote
0answers
44 views

WMI Performance Adapter function for Chrome browser?

Does someone know why the WMI Performance Adapter (WmiApSrv.exe) always starts when launching Chrome browser? Whats the function of this service? I have heared this service can be maliciously used to ...
1
vote
0answers
72 views

How do fingerprinting techniques involving Canvas and WebGL work?

Websites can fingerprint a web browser with techniques involving WebGL and HTML5 Canvas. The website like https://amiunique.org/fp shows an example of this. How exactly do these techniques work? I ...
1
vote
0answers
186 views

Bizarre request being made from Chrome

I've been seeing a very weird request being made from my Chrome browser (haven't noticed it on Brave). It does not run on all websites, and not all the time (it can appear on a website, then after a ...
1
vote
0answers
938 views

What “stability and security will suffer” by using a browser with the --no-sandbox flag?

Starting Brave browser (on linux manjaro) shows a “You are using an unsupported command-line flag: --no-sandbox. Stability and security will suffer.” message. Reading the support forums it seems that ...
1
vote
0answers
154 views

Redirection to a blank page after searching on Google with the search bar of Firefox

Today I tried to use the search bar in the top-right side of Firefox (ver 65.0 64-bit on Linux Mint 18.3 Sylvia 64-bit), and the search bar contains "search Google in Traditional Chinese". When I use ...
1
vote
0answers
74 views

How to determine if a website has been hijacked?

I noticed that the URL of a website I sometimes visit was redirecting to a new URL. I noticed this through a tool that I use that does not actually load the new URL. I was surprised by this change, ...
1
vote
0answers
93 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
1
vote
0answers
201 views

xhost si:localuser:foo security

With my current setup, I have two user accounts: internet and secure. For the user "secure", all networking is disabled with the iptables rule: -A OUTPUT -m owner --gid-owner 1000 -j DROP The user "...
1
vote
0answers
53 views

What is the current standard for complete encryption of user information?

If one were to design a social media service, but with guaranteed encrypted privacy of all aspects of one's data, what are the proper technologies to employ for all of 1.) On disk storage 2.) ...
1
vote
0answers
1k views

PWA/HTML5 recognized encrypted storage on desktop/mobile browser

Trying to find if there are recognized ways to handle Progressive Web Apps (PWA)/HTML5 type apps on desktop browsers (chrome, firefox) with some form of encrypted local storage that is sufficiently ...
1
vote
0answers
202 views

Possible vulnerability for full frontend app connecting to localhost:*

I was attempting to connect to a server that hosts my client-side app, and when using the localhost URL I am able to connect to my local dev environment instead of the servers localhost. I was ...
1
vote
0answers
141 views

Secured Web Browsing

What can be done to make a setup for super secured web browsing? I've been looking at something like this: Windows host > Sandboxie > Virtualbox > Linux Guest > Web Browser (Chrome with uBlock ...
1
vote
0answers
215 views

Browser custom protocol handlers

The possibility of running a shell command from an extension (NPAPI) has been phased out, but custom protocol handlers are still supported. What is the practical difference if an extension can still ...
1
vote
0answers
107 views

How do the antivirus safe browsers work?

Let's refer to safe browsers like Avast Safe Zone, Bitdefender Safe Pay and all those browsing tools -generally included into the paid antivirus suites- which are supposed to protect users data from ...
1
vote
0answers
50 views

Writing an automated browser - is it risky to accept downloads of any mime type?

Background about my app I have a browser macro-recording app built with Selenium. Basically users can use Firefox like normal and record their actions into macros to replay. Question In Selenium, ...
1
vote
0answers
181 views

Have there been any known “in the wild” exploits of any Google Chrome (Android) 40.0.2214.89 vulnerabilities?

https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-15031/version_id-179594/Google-Chrome-40.0.2214.89.html I looked for any news about them and couldn't find anything. Anyone ...
1
vote
0answers
124 views

Where should I store sensitive data within an Apache Cordova application?

I have to implement a 2 factor authentication (2FA) feature within an Apache Cordova application so that the user is able to login into the desktop application using the generated token. Common 2FA ...
1
vote
0answers
2k views

Google Chrome Crash Report Analysis

I am new to the field of crash analysis. I recently, by accident, happened to crash Google Chrome. I do not know the reason as to why the crash really happened. I'd like to know it in depth though. ...
1
vote
0answers
155 views

Accessing Chrome and Gmail on a stolen drive

I was trying to search for this, but could not find the answer anywhere - apology in advance if already answered. I have a Linux desktop installed on a thumb drive, which I keep in my pocket. This ...
1
vote
1answer
834 views

What are the benefits and disadvantage of disabling <TLS1.2 client side (in browser)?

We are considering disabling TLS1.0 and TLS1.1 in the policies for a browser used organization-wide. We already have a primary browser, where >=TLS1.0 is enabled (i.e. SSLv3 is disabled). We do not ...
0
votes
0answers
44 views

Allowing 3rd-party cookies in major 2020 browsers

I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
0
votes
0answers
31 views

Different Subdomains and Certificates are given from the Same Site Button when I Use Different Internet Providers

I use shenghuo.ali... site for my transaction using my home WiFi internet connection. The Shenghuo Ali site's Confirm Button worked fine last week, it redirected me to Payment Page which is expected. ...
0
votes
0answers
64 views

Is it secure to use services in Rambox?

Same question is asked for More secure to use e.g. Whatsapp Web in Franz than in browser? [closed]. On its answer it is said that: No, Franz is not inherently more secure than a regular browser. In ...
0
votes
0answers
34 views

How safe is the built in browser on the iOS Facebook app?

There is no option in the iOS Facebook app to open URLs in an external browser by default (although you can open a link, and then choose to open it in Safari). How safe (mainly from a privacy ...
0
votes
0answers
66 views

Are web worker / service worker secure environments to store a password, credit card information, access tokens?

If there is a case where I wish to store sensitive data like a password, credit card information, or access tokens: Are web workers / service workers a secure environment, where such data can not be ...
0
votes
0answers
63 views

Can someone explain the 'IE No Open' X-Download-Options Header, as enforced by Helmet.js?

I've been preparing to deploy an Express server using Helmet.js for some added security. I've been reading through their docs to make sure I understand what I am doing here, and I don't understand one ...