Google Chrome 80 update may put privacy of web users of at risk

Google Chrome 80 is now rolling to users but researchers have found that the updated browser has a few bugs that may put the privacy of users at risk.

Earlier this month, Google rolled out the latest update to Chrome browser. The update was called Google Chrome 80 and among others it includes a new feature called the Scroll to Text Fragment, which lets users add a phrase to the URL bar and then let the browser scroll to that particular phrase on the web page automatically. It’s a neat feature, particularly on dense web pages or the sort of pages that have lots of text on them such as the pages on Wikipedia. Unfortunately, this feature is also a privacy risk.

Peter Snyder, who works for US-based Brave Web Browser, has raised concerns regarding this new feature. According to his note, the Scroll To Text Fragment feature enables potential attacker or hacker to gain access to a web user’s private information. This is possible due to a bug in the feature. For instance a potential attacker can access information as basic but significant like details of a person’s private followers on Twitter or Facebook through a highlighted link.

Peter Snyder gave an example: “For example: Consider a situation where I can view DNS traffic (e.g. company network), and I send a link to the company health portal, with #:~:text=cancer. On certain page layouts, I might be able tell if the employee has cancer by looking for lower-on-the-page resources being requested”

What Snyder is trying to say is that if someone highlights the word cancer on a specific webpage, an attacker can come to know if that person has cancer by getting hold of his private information through this highlighted link.ADVERTISEMENT

According to a report in the Bleeping Computer, all major developers are part of W3C’s Web Platform Incubator Group (WICG). This platform is used to propose new features before they are added to browsers. This platform enables outside developers and security researchers to question any issues regarding technical, security or privacy concerns.

These issues related to this new feature were raised before the Chrome 80 was released. However, Google decided to go ahead with the launch anyway. We understand the issue but disagree with the severity so we’re proceeding with allowing this without requiring opt-in (though we are still working on adding an opt in/out),” stated Google Chrome developer David Bokan.

Snyder even brought it up with Google as he thought that the feature could invite privacy risks. Google reportedly did not address this issue while making the feature live. To this, Snyder responded by saying that there is no use of introducing platforms like WICG when its sole purpose is not met.