New issue
Advanced search Search tips

Issue 828303 link

Starred by 1 user
Status: WontFix
Owner: ----
Closed: Apr 2018
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug



Sign in to add a comment

Security: Switching between logged in Google identities in content area does not affect all tabs

Reported by ro...@oustlabs.com, Apr 3 2018 
VULNERABILITY DETAILS
Open chrome and login with one user say A.
Now switch from user A to B . Now you logged in B.

Now Open other tab and observe that the account switch hasn't been done . And your previous data can still be accessed. 

VERSION
Version 65.0.3325.181 (Official Build) (64-bit)
record123 (1).mp4
2.6 MB View Download

Comment 1 by elawrence@chromium.org, Apr 3 2018

Summary: Security: Switching between logged in Google identities in content area does not affect all tabs (was: Security:)
I believe this is a design decision in the Google Identity feature, not a bug in any client.

The video definitely doesn't show a security bug, insofar as it requires local access, and the local "attacker" could just switch identities themselves.

Comment 2 by jialiul@chromium.org, Apr 3 2018

Labels: -Type-Bug-Security -Restrict-View-SecurityTeam Type-Bug
Status: WontFix (was: Unconfirmed)
I agree with elawrence@. Based on the video, it all happens in the content area and related to Google identity (which is not a Chrome feature). Therefore, it is out of the scope of Chrome. 

Marking as won't fix. And removing security labels.
►

Sign in to add a comment