New issue
Advanced search Search tips

Issue 598199 link

Starred by 1 user
Status: WontFix
Owner: ----
Closed: Mar 2016
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: Chrome Private Data Leak

Reported by itsderek...@gmail.com, Mar 27 2016 
VULNERABILITY DETAILS
User A uses Chrome as primary browser but never signs in to the browser itself, only Google web sites. User B opens Chrome and signs in to their Google account. Once done, User B signs out of Chrome and removes their profile. User B now has all of User A's private information (logins, autofill data, bookmarks) saved to their Google account.

I have duplicated this issue twice now on friends' computers -- one running Windows and a MacBook. I can now login as them from my phone or tablet then switch immediately to Gmail and delete the "new sign from device" email. This is a severe security oversight. All Chrome data generated when no one is logged in should be kept separate from users who log in to Chrome.

VERSION
Chrome Version: Version 49.0.2623.108 m (stable)
Operating System: Windows 10 Pro Version 1511 OS Build 10586.104 + brand new MacBook Pro (version unknown)

REPRODUCTION CASE
Included is a screenshot of me able to use and login as both of my friends on my cellphone. Neither one has ever touched any of my devices. I am doing this solely off data added to my Google account when I logged into their Chrome browsers.
Screenshot_2016-03-25-23-33-46.png
237 KB View Download
Screenshot_2016-03-27-18-06-25.png
202 KB View Download

Comment 1 by wfh@chromium.org, Mar 27 2016

Labels: -Restrict-View-SecurityTeam OS-Windows
Status: WontFix (was: Unconfirmed)
if User B has access to User A's computer then they can do anything they want, not just limited to logging into Chrome as themselves; they could just copy User A's entire user data onto a USB stick.

This is called a 'physically local attack' and is not covered by Chrome's threat model see https://www.chromium.org/Home/chromium-security/security-faq#TOC-Why-aren-t-physically-local-attacks-in-Chrome-s-threat-model-

It is recommended that you use a screen lock and a strong OS password to prevent attacks such as these.
Project Member

Comment 2 by sheriffbot@chromium.org, Oct 1 2016 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Project Member

Comment 3 by sheriffbot@chromium.org, Oct 2 2016 

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Comment 4 by mbarbe...@chromium.org, Oct 2 2016

Labels: allpublic
►

Sign in to add a comment