Issue metadata
Sign in to add a comment
|
Chrome stores passwords in an unencrypted SQLite Database.
Reported by
elijahcu...@gmail.com,
May 27 2018
|
||||||||||||||||||||||
Issue descriptionI have been looking into the password storage location of Google Chrome for Android, i have found that the SQLite Database "Login Data" holds all Login's from chrome in unencrypted or unprotected format. VULNERABILITY DETAILS After researching for a few day's, a root access application could clone this SQLite database with hardly any problems whatsoever, potentially releasing private information. VERSION Chrome for Android Version: [50.0.2661.89] + [stable] Operating System: [Android 5.1.0 / ZTE Blade A475] REPRODUCTION CASE To reproduce my findings, open the "Login Data" SQLite database under /data/data/com.android.chrome/app_chrome/Default/Login Data All saved passwords are available with no encryption. ( You may notice that a substitute will be used to mask the password ( pass, password ).. Opening the SQLite Database as a Text file, will remove all masking ! )
,
May 28 2018
https://chromium.googlesource.com/chromium/src/+/master/docs/security/faq.md#Why-arent-compromised_infected-machines-in-Chromes-threat-model
,
Sep 3
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by elawrence@chromium.org
, May 28 2018Labels: OS-Android
Mergedinto: 803054
Status: Duplicate (was: Unconfirmed)