New issue
Advanced search Search tips

Issue 705063 link

Starred by 2 users

Issue metadata

Status: WontFix
Owner: ----
Closed: Mar 2017
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: Google Account Password and Password Manager Exposure After Chrome or System Crash

Reported by ktmcnam...@gmail.com, Mar 24 2017

Issue description

VULNERABILITY DETAILS
If Chrome crashses and is shut down, a user returning to Chrome can choose to restore previuously opened pages.  Even if Chrome settings areset to "keep local data only until you quit your browser", a user can reopen Chrome and will be still be logged in to the previous user's Google account.  If a user has chosen "offer to save your web passwords", then a person reopening Chrome has full access to a user's Google account, including any passwords for other accounts that are saved in Google password manager. The second user might not be able to see the passwords in plain text in all cases but if Chrome is also set to autofill passwords, then they don't need to see the password; it will be filled in automatically.  This vulnerability can be exploited even if a Google account is secured with two-factor authorization (at least if a user uses the Google Authenticator app, which I do). 

A user who is under the impression that once Chrome has been closed (after a crash, for example), login credentials will be required to gain access to his or her Google account, would be mistaken. If he or she made this assumption and walked away from his or her computer after Chrome crashed, someone could simply open the browser and would be logged into that person's account (for example, the user's wife or an unfriendly co-worker). If a network administrator could somehow remotely force a Chrome crash, I suppose that would also be a vulnerability.      

This vulnerability would even allow that second user to reset the Google account password.  This vulnerability occured on my system even when the operating system was accidentally shutdown due to a power loss.  In the latter case, a user would need the Windows user's account password to log back into the user's Window account to exploit the vulnerability but a user would not need the user's Windows password if the Windows account didn't require a password.  


VERSION
Chrome Version: Version 57.0.2987.110 (64-bit) stable
Operating System: Microsoft Windows 10 Pro Version 10.0.14393, Build 14393, Version 1607

REPRODUCTION CASE
I am not technically inclined and do not know how to provide evidence of the reproducibility of the event but I can tell you that if you know how to make Chrome crash (which I don't), you can reproduce it.  Also, I'm sure you know how to cause a power outage but if you don't, just pull the power plug and you can possibly reproduce it that way too.
 
Physically-local attacks are outside of the browser's threat model: https://dev.chromium.org/Home/chromium-security/security-faq#TOC-Why-aren-t-physically-local-attacks-in-Chrome-s-threat-model-

Re: "keep local data only until you quit your browser" -- You're referring to the "Cookies" setting in chrome://settings/content, right?

> "If a user has chosen "offer to save your web passwords", then a person reopening Chrome has full access to a user's Google account, including any passwords for other accounts that are saved in Google password manager."

This is expected and isn't related to crashing at all; see the discussion of local attacks.

>"a user would not need the user's Windows password if the Windows account didn't require a password."

If the user hasn't protected their OS account, then a physically local attacker has complete access to the user's data, regardless of what Chrome does.

Status: WontFix (was: Unconfirmed)
Well-explained elawrence@!

Marking this issue as Won'tFix. 
Thank you!  I think I should stick to my day job. 
Project Member

Comment 4 by sheriffbot@chromium.org, Jul 1 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment