DLL preloading is not considered a security bug, since anyone who already has access to write to Chrome's application folder can do anything they want including but not limited to, just replacing chrome binaries with anything else including malicious ones.

Do you think this is a regression?

Now I'm windows sheriff also, I'm closing this as WontFix, given our threat model.

OK   Thanks

Because my app have the same problem  ,  my company's security team tell me
that is a bug,  they want me to fix it.

I told them google chrome、 microsoft lync... have the same problem , but
they didn't trusted to me. I just want to prove it is not a bug.

Because  Google say DLL proloading is not a security bug.

Thanks again.

2018-06-15 3:57 GMT+08:00 w… via monorail <
monorail+v2.543067860@chromium.org>:

DLL preloading onto an application whose directory requires administrator access to write to, is not a bug.

However, if your application was running directly from a writable directory e.g. running directly from the user's download directory (this is typically apps like installers), then it would be a bug.