New issue
Advanced search Search tips

Issue 847090 link

Starred by 2 users

Issue metadata

Status: Duplicate
Merged: issue 803054
Owner: ----
Closed: May 2018
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: ----
Type: Bug-Security



Sign in to add a comment

Chrome stores passwords in an unencrypted SQLite Database.

Reported by elijahcu...@gmail.com, May 27 2018

Issue description

I have been looking into the password storage location of Google Chrome for Android, i have found that the SQLite Database "Login Data" holds all Login's from chrome in unencrypted or unprotected format.

VULNERABILITY DETAILS
After researching for a few day's, a root access application could clone this SQLite database with hardly any problems whatsoever, potentially releasing private information.

VERSION
Chrome for Android Version: [50.0.2661.89] + [stable]
Operating System: [Android 5.1.0 / ZTE Blade A475]

REPRODUCTION CASE
To reproduce my findings, open the "Login Data" SQLite database under /data/data/com.android.chrome/app_chrome/Default/Login Data 
All saved passwords are available with no encryption. 

( You may notice that a substitute will be used to mask the password ( pass, password ).. Opening the SQLite Database as a Text file, will remove all masking ! )


 
Components: UI>Browser>Passwords
Labels: OS-Android
Mergedinto: 803054
Status: Duplicate (was: Unconfirmed)
Correct, although it is worth noting that using encryption wouldn't be useful on a rooted device. 
Project Member

Comment 3 by sheriffbot@chromium.org, Sep 3

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment