Issue metadata
Sign in to add a comment
|
Security: Google Account Password and Password Manager Exposure After Chrome or System Crash
Reported by
ktmcnam...@gmail.com,
Mar 24 2017
|
||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS If Chrome crashses and is shut down, a user returning to Chrome can choose to restore previuously opened pages. Even if Chrome settings areset to "keep local data only until you quit your browser", a user can reopen Chrome and will be still be logged in to the previous user's Google account. If a user has chosen "offer to save your web passwords", then a person reopening Chrome has full access to a user's Google account, including any passwords for other accounts that are saved in Google password manager. The second user might not be able to see the passwords in plain text in all cases but if Chrome is also set to autofill passwords, then they don't need to see the password; it will be filled in automatically. This vulnerability can be exploited even if a Google account is secured with two-factor authorization (at least if a user uses the Google Authenticator app, which I do). A user who is under the impression that once Chrome has been closed (after a crash, for example), login credentials will be required to gain access to his or her Google account, would be mistaken. If he or she made this assumption and walked away from his or her computer after Chrome crashed, someone could simply open the browser and would be logged into that person's account (for example, the user's wife or an unfriendly co-worker). If a network administrator could somehow remotely force a Chrome crash, I suppose that would also be a vulnerability. This vulnerability would even allow that second user to reset the Google account password. This vulnerability occured on my system even when the operating system was accidentally shutdown due to a power loss. In the latter case, a user would need the Windows user's account password to log back into the user's Window account to exploit the vulnerability but a user would not need the user's Windows password if the Windows account didn't require a password. VERSION Chrome Version: Version 57.0.2987.110 (64-bit) stable Operating System: Microsoft Windows 10 Pro Version 10.0.14393, Build 14393, Version 1607 REPRODUCTION CASE I am not technically inclined and do not know how to provide evidence of the reproducibility of the event but I can tell you that if you know how to make Chrome crash (which I don't), you can reproduce it. Also, I'm sure you know how to cause a power outage but if you don't, just pull the power plug and you can possibly reproduce it that way too.
,
Mar 24 2017
Well-explained elawrence@! Marking this issue as Won'tFix.
,
Mar 25 2017
Thank you! I think I should stick to my day job.
,
Jul 1 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||
Comment 1 by elawrence@chromium.org
, Mar 24 2017