New issue
Advanced search Search tips

Issue 792917 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Dec 2017
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug-Security



Sign in to add a comment

Administrator Bypass

Reported by 2b...@cbaalbany.org, Dec 7 2017

Issue description

UserAgent: Mozilla/5.0 (X11; CrOS x86_64 9334.58.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.89 Safari/537.36
Platform: 9334.58.0 (Official Build) stable-channel kefka

Steps to reproduce the problem:
1. Download "Tampermonkey" Extension on google web store.
2. install "UserJS unblock sitesv1.0" on "https://greasyfork.org/en/scripts/7177-userjs-unblock-sites/code
3. use the code on tampermonkey extension

What is the expected behavior?

What went wrong?
The code effectively bypasses all system administrator blockings onto ChromeOS device, I have not tried it on other operating systems but I am expecting the same will happen.

Did this work before? N/A 

Chrome version: 58.0.3029.89  Channel: n/a
OS Version: 9334.58.0
Flash Version: 

I am sorry I can not attach a document but the exact download link is https://greasyfork.org/en/scripts/7177-userjs-unblock-sites/code.
 
What exact system administrator restrictions is this bypassing? Anything that can be bypassed by injecting Javascript on websites is not really a security bug.

Comment 2 by kochi@chromium.org, Dec 11 2017

Status: WontFix (was: Unconfirmed)
The user script tries to show Google's cached content on the blocked site
(probably by your local site IT management).  This is not what Chrome or
any extension system can control.

Comment 3 by kochi@chromium.org, Dec 11 2017

Clarification:

The user script does a redirect to Google's cached content when it sees
your access to any site is blocked (probably by your local site IT
 management).  This means that Google's cached content is not blocked
by your IT admin.

If you want these sites also blocked, talk to your IT manager about
prohibiting installing such extensions on every managed Chrome clients,
or also block such cached content.

Project Member

Comment 4 by sheriffbot@chromium.org, Mar 19 2018

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment