chrome Archives - Page 5 of 6 - Chipp.in Tech News and Reviews

Google fixes Chrome security issue that is exploited in the wild

Posted on May 10, 2024May 10, 2024 by Martin Brinkmann

Just days after the weekly Google Chrome security update comes another security update for the web browser. This one unscheduled, as it fixes a 0-day security issue in Google Chrome that is exploited in the wild.

Google Chrome users should update the browser immediately to protect the browser and their data. Here is how that is done:

Open Google Chrome on a desktop system.
Select Menu > Help > About Google Chrome.

The browser displays the current version and runs a check for updates. It should pick up the security update and install it automatically.

Windows users may also launch a command prompt window and run winget upgrade Google.Chrome.EXE to update the browser to the latest version.

One of the following versions should be displayed by Chrome after installation of the update:

Chrome for Windows or Mac: 124.0.6367.201 or 124.0.6367.202
Chrome for Linux: 124.0.6367.201
Chrome Extended for Windows or Mac: 124.0.6367.201

The Chrome 0-day security issue: what we know

Google reveals little about the security issue on the official Chrome Releases website.

[N/A][339266700] High CVE-2024-4671: Use after free in Visuals. Reported by Anonymous on 2024-05-07
Google is aware that an exploit for CVE-2024-4671 exists in the wild.

The security issue is rated high and it is a use after free in Visuals. It was reported to Google on May 7, 2024, which means that it could have been exploited at least since that date. It is unclear how this issue can be exploited.

Other Chromium-based web browsers are also affected by the issue. This means that browsers such as Microsoft Edge, Vivaldi, Brave, or Opera are all vulnerable until an update is released.

Expect updates for these browsers in the coming hours and days.

Chrome on Android does not seem to be affected by the issue, as Google has not published an update for the browser or made an announcement on the releases blog regarding the platform.

When do you update browsers?

How to create screenshots of a full webpage

Posted on April 7, 2024April 7, 2024 by Martin Brinkmann

If you found great helpful content online, you may want to save it for safe keeping. Screenshots are one option to do that. There are others, including saving the entire webpage to the local system or using tools such as SingleFile.

All operating systems support the creation of screenshots natively. On Windows, you’d just use Ctrl-Print to capture a screenshot. These screen capturing options are useful, but they are not ideal when it comes to capturing entire webpages, as they only capture the visible part.

Browsers with native screenshot tools

Several web browsers include native screenshot tools. Here is a list and how you activate the built-in screenshot function:

Microsoft Edge — Open menu and select screenshot from the list of options. Pick capture full page next and use the save icon to download the screenshot of the webpage to your system.
Mozilla Firefox — Right-click anywhere on the page and select take screenshot from the menu. Select Save full page to create a screenshot of the entire webpage. It takes a moment before a preview is displayed. Use the download button to save it to the local system.
Opera — Select the snapshot icon in the address bar to create a screenshot. Activate the capture full webpage button to create a screenshot of the entire webpage. Options to edit the screenshot and save it to the local system are provided after a moment.
Vivaldi — Activate the camera icon in Vivaldi’s status bar to open the screenshot options. Select full page and then the capture button to save the screenshot to the local system.

Browsers that require an extension to take screenshots

Google Chrome — You may use a browser extension such as GoFullPage or FireShot to capture entire pages.

Technically, Chrome supports capturing screenshots natively. The feature is available in the Developer Tools, which makes it difficult to access. Still, it may be an option if you do not want to install a browser extension for creating screenshots.

Here is how you use it:

Open the webpage that you want to create a whole screenshot from.
Use Ctrl-Shift-I to open the Developer Tools. On Mac, you use Command-Option-I. This opens the Developer Tools interface.
Use Ctrl-Shift-P to open the run box. On Mac, you use Command-Shift-P instead.
Type screenshot and select capture full size screenshot.
Chrome saves the screenshot to the local system.

Bonus Tip: Android

Android’s native screen capturing tool supports full webpage captures. You may know that you can take a screenshot of the visible screen by pressing the Power and Volume Down buttons at the same time.

Android displays several options afterwards. This includes a a “down” icon. Press it once and Android scrolls down a bit on the webpage and appends more to the screenshot automatically.

Tip: press and hold the icon until the end of the page is reached to create a full webpage screenshot.

Do you take screenshots of webpages? If so, how do you capture them and why? If not, do you use a different method to save information?

Limit: Set daily Time Limits for distracting websites in Chrome

Posted on April 5, 2024April 5, 2024 by Martin Brinkmann

Browser extension Limit promises to keep you focused on important tasks by setting time limits for distracting websites.

We have all been there probably: you need to focus on “something” important on your electronic devices but are distracted all the time. Notifications, chat messages, a quick browse on YouTube, checking your social media feed, or something else. The Internet is full of distractions.

Not everyone has the focus of a Shaolin Monk who keep focused no matter what. Extensions like Limit promise to help you out.

Limit – daily time limits for distracting websites

Limit is a browser extension for Google Chrome and also other Chromium-based browsers. It worked well in Microsoft Edge, Brave, Opera, and Vivaldi during tests.

The core idea behind the extension is to set access limits for certain websites. In other words: you may access the sites for the set limit only on any given day.

The extension is developed by the makers of Freedom. Freedom is the big brother of Limit. It runs system-wide, which means that it can also block distracting apps on supported systems.

Limit comes with a list of preset sites. These include some of the worst offenders when it comes to distractions, including YouTube, Netflix, Reddit, and Facebook. These sites can be removed from the configuration.

There is also an option to add any website. Just open the Settings of the extension, type the domain name, e.g., chipp.in, and activate the “add website” button.

Limit displays a notification when a time-limited website is opened. It reminds you of the time limit. Hover over the extension icon in the browser’s interface to get detailed information on the time spent and time left.

Limit blocks access to the website once you reach the set time limit.

Caveats

Limit is provided as a browser extension. It works therefore only in select browsers. While that may be sufficient if you just need a little push in the right direction to remain focused, it is quite easy to bypass the limits.

Apart from changing the daily time limit for the site to get more play time, using another browser is also an option to bypass the restriction.

If that is not enough, there are plenty of additional options available. Access the site using its IP address, use a proxy service, or a screenshot service.

Obviously, since you are in control, you may also uninstall the extension at any time or disable it.

Closing Words

Limit’s main goal of reducing the time spent on distracting websites depends entirely on the user. If you just need a little push, it may work well to keep you focused. If you need a bulletproof option, Limit is not the right extension for you. Freedom might work better, but it is a subscription-based service.

Now You: how do you handle distractions while working?

Cookie stealing may soon be a thing of the past

Posted on April 3, 2024April 3, 2024 by Martin Brinkmann

Google is working on a new security feature for the Web that aims to protect users against cookie theft malware better. Called Device Bound Session Credentials (DBSC), its main purpose is to bind cookies to the user’s device.

To better understand this, it is necessary to analyze the current situation. When you sign-in to a web service, a cookie is usually saved to the local system. This session cookie may then be used in future sessions. The effect is that you do not need to sign-in again, as this has been done in the past.

Cookies expire eventually, but until that happens, they may be used. One of the problems that arises is that cookies may also be used on other systems. This is what makes them attractive to criminals. If they manage to get their hands on session cookies, they may access the service without authentication.

A subtype of malware is designed to find and extract cookies from user systems. While this requires access to the user’s system in one way or another, it is a fairly common type of attack.

Device Bound Session Credentials

As the name implies, Device Bound Session Credentials limit cookies to individual devices. If you sign-in to a web service, the boundary is your computer (or a particular application). Anyone stealing the cookie cannot use it to access the account on another device, thanks to the new protective system.

Google explains:

By binding authentication sessions to the device, DBSC aims to disrupt the cookie theft industry since exfiltrating these cookies will no longer have any value.

Google admits that attackers may still get value out of attacks, but only if they act on the user system thanks to the boundary.

Technically, DBSC uses key pairs that are created when a new session starts. The private key is stored by the operating system and protections such as TPM help protect the keys against attacks. Servers may associate sessions with the public key; this ensures that a session is still on the original device.

Google notes that there is no “persistent user tracking” as sites may not “correlate keys from different sessions”. Keys may also be deleted at any time using the browser, e.g., Chrome’s option to delete site data.

Going forward

Google has open sourced the project and plans to make it a public standard. It is already experimenting with a prototype in Chrome Beta that protects Google Account users. Some companies, including Microsoft, have expressed interest already in DBSC.

You can check out Google’s post on the Chromium blog for an overview or the technical explainer on GitHub for additional information.

How to deal with Notifications in Google Chrome

Posted on March 26, 2024March 26, 2024 by Martin Brinkmann

All modern web browsers support so-called push notifications. Websites may request permission to send notifications. When users accept, they may push notifications to the user’s system. Ideally, these are useful to the user. Maybe about a new post on the site, an auction running out, or about item availability in online stores.

Most of the time, at least from my experience, notifications are not that helpful for users. Sites may push lots of notifications to user systems. Abuse is rampant. Notifications may get abused for advertisement, scams, or malicious attacks.

While notifications contain no executable content, clicking on notifications may launch sites and thus attacks.

You can check out this recent story on Bleeping Computer for an example of attacks. The attack originated on Google Search and used notifications to push spam and malware.

One of the best options to deal with notifications is to disable them. This works well for users who never use them in the first place. Those who do use notifications on specific sites may also optimize their configuration.

The following paragraphs explain how that is done. Note that this applies to other Chromium-based browsers as well. All offer these options, and you may load the URL provided below to open the Settings.

Blocking Notifications in Chrome permanently

It takes just a few steps to block notifications in Google Chrome.

Load chrome://settings/content/notifications in the Chrome address bar. You may also open Menu > Settings > Privacy & Security > Site settings > Notifications manually.
Set the default behavior to “Don’t allow sites to send notifications”.

You are done. Chrome won’t send any notifications from this moment up. There is one exception, and this is handy to allow specific sites to send notifications while disallowing them from any other site.

Scroll down to the customized behaviors section. There you find overrides. Use the “allowed to send notifications” section to allow specific sites to send notifications to your system.

Activate the “add” button and type the domain name using the following format: [*.]domain.com.

This allows the domain to send notifications, even though the general setting is set to disabled.

Tip: you can also allow sites in the following way:

Open the site in the Chrome browser.
Click on the icon that is in front of the domain name in Chrome.
Select Site Settings from the menu.
Locate the Notifications preference and set it to “allow”.

Closing Words

My recommendation is to turn off Notifications and use the allow list for select sites only. This blocks all notification spam and any attempt to use notifications for malicious attacks. It also prevents less tech savvy users from accepting notifications on a regular basis in the browser.

Google turns Safe Browsing real-time checks on in Chrome

Posted on March 15, 2024March 15, 2024 by Martin Brinkmann

Announced last year, Google has now enabled real-time Safe Browsing checks in its Chrome web browser.

Safe Browsing is a security component of the Google Chrome web browser. Its main purpose is to warn users about malicious websites or downloads. This includes protections against known phishing websites and malware.

Google Chrome used a local list of known malicious sites by default previously. This list was updated every 30 to 60 minutes by the browser. This meant that there was a short period in which new known threats were not blocked by the browser.

Google calculated that “average malicious” sites exist for less than 10 minutes. In other words, a good portion of malicious sites do not exist anymore when Chrome updates the local Safe Browsing list.

Chrome users could switch the security setting to enhanced to get real-time checks. This new real-time checking of threats is now available in all Safe Browsing modes.

Safe Browsing changes

Google Chrome uses a Safe Browsing list on Google servers now to check any site that is getting opened against it. This improves the protection of users. Google estimates that this should improve the blocking of phishing attempts by 25%.

The change is rolling out to Chrome desktop users already. Android will also get the change “later this month” according to Google.

The option to enable Enhanced Protection is still available. This includes real-time checks as well, but also use of “AI to block attacks, provides deep file scans and offers extra protection from malicious Chrome extensions”.

What about privacy?

Google says that the new real-time nature of Safe Browsing checks is privacy-preserving.

Here is what happens in Chrome when a site is visited (according to Google):

The cache is checked to see if the site is known to be safe already.
If it is not in the cache, Chrome needs to check it against the remote Safe Browsing list.
Chrome starts by obfuscating the URL locally into 32-byte full hashes.
The hash is then truncated into 4-byte long chunks.
These are encrypted by Google Chrome and transferred to a “privacy server”.
The privacy server removes “potential user identifiers” before forwarding the encrypted hash chunks to the Safe Browsing server.
There the data is decrypted and checked against the database.
If a match is found, Chrome shows a warning to the user.

Google entered into a partnership with Fastly to “operate an Oblivious HTTP privacy server” that sits between the Chrome web browser and Safe Browsing.

The main idea behind Oblivious HTTP is to block the receiving server from linking requests to specific clients. Google published a blog post on the Chrome Security blog that offers additional information on the implementation in Chrome and server infrastructure.

Closing Words

Real-time checks should improve protection for users without impacting their privacy. Other browsers who also use Safe Browsing may not be affected by the change if they download Safe Browsing lists instead of using real-time checks.

Those who use Chrome but do not want these real-time checks can turn off Safe Browsing

Under New Management: Chrome extension checks if extension owner has changed

Posted on March 7, 2024March 7, 2024 by Martin Brinkmann

Under New Management is a new extension for Google Chrome and Chromium-based browsers. Its main purpose is to notify users when the owner of installed extensions changes.

Here is why that is important: an entire ecosystem of companies exist that buy extensions to, usually, exploit the userbase and extract as much money as possible from it.

Popular extensions may sell for five or even six figures. This is mostly based on the userbase, but factors such as the rating, comments, or track record play a role as well.

When an extension gets sold, the new owners may implement money making functions. These cross borders often, for instance, by tracking users and selling data, or by changing ads on the screen or affiliate links.

The main problem for users is that ownership changes are not announced by the browser. It would be simple, but no browser does that at the moment.

Under New Management

Under New Management adds checks and notifications to Chrome and other Chromium-based browsers.

The developer describes how the extension works on its GitHub repository site:

Intermittenty checks your installed extensions to see if the developer information listed on the Chrome Web Store has changed. If anything is different, the extension icon will display a red badge, alerting you to the change.

The extension checks the Chrome Web Store for changes and warns users if it detects any.

It checks the following parameters:

Developer name
Developer website
Extension name
Offered by name
Developer email
Extension ID

If any of these change, it will notify you about it. All it takes is to install the extension in a Chromium-based browser.

Note: there is a chance that an extension may get sold but that the information is not changed.

Blocking automatic extension updates in Google Chrome

Another option that you have is to block automatic extension updates. Google Chrome and most Chromium-based browsers do not offer any Setting in this regard, however.

The idea here is to verify extension updates before allowing them.

As a side note, Mozilla Firefox does. Load about:addons in the browser’s address bar, activate the settings icon on the page and uncheck “pdate Add-ons Automatically” with a click on the entry.

Extensions won’t auto-update from that moment up, but you may still update them.

The only option for Chrome and most Chromium-based browsers is a bit complicated. It requires that you enable Developer Mode in the browser and load the extension in its unpacked state. Note that I have not tried this extensively.

Unpacked extensions do not get updated automatically, as they are loaded from the local system. It gives you control, but it means that you have to update these extensions manually each time.

Now You: how many and which extensions do you use?

How to add scroll buttons to Chrome’s tab bar

Posted on February 26, 2024February 26, 2024 by Martin Brinkmann

Google Chrome has a hidden setting to enable scrolling on the tab bar. This guide explains how to enable the feature in the browser.

When you open a lot of tabs in Chrome, you will come to a point where no tab gets added to the tab bar anymore. This is only a visual limitation of the browser. Tabs continue to get launched, but you cannot reach them from the tab bar.

The reason for that is that Chrome lacks tab scrolling options by default. While there are other ways to access invisible tabs, for instance by using Chrome’s Search tabs feature, it is far from ideal.

You may launch Search tabs with a click or tap on its icon in the tab bar. The keyboard shortcut Ctrl-Shift-A launches it as well.

Another option that you have is to use tab groups, as you may collapse them on the tab bar. Google added the option to save tab groups recently to Chrome.

Tab Scrolling in Google Chrome

Tab Scrolling in Chrome — Tab Scroll buttons in Google Chrome

The screenshot of Google Chrome’s interface shows tab scroll buttons. The left and right buttons scroll the tab bar in the selected direction. This is useful when the open tabs do not fit on Chrome’s tab bar.

How to show tab scroll buttons in Chrome

Here is how you enable Tab Scrolling in Chrome:

Load chrome://flags/#scrollable-tabstrip in the Google Chrome address bar.
Set the status of the feature to Enabled.
Restart Google Chrome.

Note that Chrome displays scroll buttons only if too many tabs are open. The feature comes with configuration options. Tab scrolling does not change the minimum size of tabs in Chrome by default.

You may alter that as well by changing the status of Tab Scrolling.

The available customization options change the minimum size of tabs in Google Chrome. The following states are supported:

Tabs shrink to pinned tab width.
Tabs shrink to a medium width.
Tabs shrink to a large width.
Tabs don’t shrink.

The default state reduces the size of tabs to the pinned tab width. This is the smallest option. You may change that to medium, large, or no shrinking. Fewer tabs are shown then in the tab bar as a consequence.

Here is a screenshot of the medium width setting:

Other customization options

Chrome includes several customization options to further personalize the experience. The first option adds permanent scrolling buttons to Chrome’s interface, even if all tabs are shown on the tab bar.

The second enables drag scrolling. This does not require tab buttons to show on the tab bar, and may be an option for some users.

Chrome Tab Scrolling customization options

Here is how you enable and configure the options. First, the permanent scroll buttons.

Load chrome://flags/#scrollable-tabstrip in the address bar of the browser.
Set the feature to one of the following states:
- Enabled — the default state.
- Enabled to the right of the tab strip — places the scroll buttons on the right side.
- Enabled to the left of the tab strip — places the scroll buttons on the left side.
- Enabled on both sides of the tab strip — places them on the left and on the right side.

This setting places a set of buttons or two sets of buttons to scroll tabs on Chrome’s tab bar.

Now tab scrolling.

Load chrome://flags/#tab-scrolling-button-position in the Chrome address bar.
Set the feature to one of the following states:
- Enabled — the default state.
- Enabled tabs scrolling with constant speed.
- Enabled tabs scrolling with variable speed region.
Restart Google Chrome.

This feature enables tab scrolling using drag operations. The default option scrolls tabs at a constant speed, the other accelerates based on how far to the right you drag the selected tab.

Closing Words

Tab scrolling is an experimental feature of the Chrome browser. This means, that it could be removed at one point by Google. The feature has been available for years, however, and it seems unlikely that it is going to be removed any time soon.

Now You: how many tabs have you open in your browser?

How to save Tab Groups in Google Chrome

Posted on February 25, 2024February 25, 2024 by Martin Brinkmann

The ability to create tab groups is a powerful feature that most browsers support. It allows you to group tabs together, which improves management of tabs significantly.

Tab groups can be collapsed to reduce them to a single icon on the tab bar. Excellent if you need space on the tab bar for other tabs.

Google Chrome and other Chromium-based browsers support tab groups, but most did not support the saving of groups. Note that saving is different from syncing.

Saving in this context means adding all sites of a tab group to the browser’s bookmarks. Bookmarks are stored locally by default, but if sync is enabled, are synced with other data to other devices.

Note: you may see the save group option in many Chromium-based browsers, not just Google Chrome. The functionality is identical.

Saving tab groups in Google Chrome

You need at least one tab group in Chrome to use the save feature. All that is required is to right-click on the tab group label and select “Save group” from the options.

Chrome adds a new icon to the label to indicate that the group has been saved. The group is saved to the bookmarks bar. One easy way to verify this is by selecting Menu > Bookmarks and lists > Show Bookmarks Bar. You may also use Ctrl-Shift-B to show or hide it.

There is one caveat. The saving option synchronizes data between the tab group and the bookmarks bar. Any change you make to the group in Chrome is automatically synced to the bookmarks folder. If you close the entire tab group, it is deleted from the bookmarks bar.

To go around this, Google has added the option to hide and show tab groups. Hiding removes the tab group from Chrome’s tab bar without deleting the saved bookmark information.

You may then launch the saved tab group again with a click on its listing in the bookmarks bar. It remains saved there when you do so.

Closing Words

The Save Group option syncs all open tabs of a group to the bookmarks bar. This is useful in conjunction with the hide group option, as it allows you to launch tab groups only when they are needed and hide them the rest of the time.

The save option is not a backup feature, on the other hand. Since it syncs all changes, tabs are removed permanently if you close them.

How to remove an entire site from your browser’s history

Posted on February 19, 2024February 19, 2024 by Martin Brinkmann

This guide explains how to remove all history entries of a specific websites from the browser’s Google Chrome, Microsoft Edge, Brave, Vivaldi, Opera, and Mozilla Firefox. It should work in most other browsers as well.

All web browsers record the websites that you visit while using them. The browsing history serves two main purposes: to highlight previously visited sites when you type in the address bar, and as a record for the user to look up previously visited sites.

Sometimes, you may want to remove sites from the browsing history. Maybe because you do not need a record of the site anymore or want it to disappear completely from the browsing history.

All desktop browsers include functionality to do that. Problem is, it is not clear exactly how it is done. Opening the browsing history displays all visited sites, but there is no option to remove a specific site from the browsing history.

Clearing the entire history works, but it results in a loss of all records.

Delete a site from Google Chrome’s history (and other Chromium-based browsers)

Remove site from browsing history in Chrome

The general method of removing a site’s records from the Chrome browsing history works also in all other Chromium-based browsers. It works in Microsoft Edge, Brave, Vivaldi, Opera, and all other desktop versions of these browsers.

Here are the required steps:

Select Menu and then History > History in the browser. You may also use the keyboard shortcut Ctrl-H to open the history, or load chrome://history/ directly.
Use the search history field at the top to find all entries of the website that you want to delete. The best option is to type its domain name, e.g., chipp.in.
Scroll all the way down to the end. Chrome lists only some of the entries by default. You may also repeat the operation multiple times if there are too many records.
Now check the box of the last entry on the page.
Scroll all the way to the top.
Hold down the Shift-key and click the box of the first history entry. All entries are now checked.
Select the Delete option.
Confirm the deletion.

Here is how this looks in other Chromium-based browsers:

The process should work in all Chromium-based browsers. Most redirect chrome://history to “their” internal page protocol, e.g., vivaldi://history or edge://history/all.

How to clear a site from Firefox’s browsing history

Mozilla’s Firefox web browser supports a similar feature. It works differently, as it is not based on Chromium.

Here are the steps in Firefox:

Select Menu > History > Manage History.
Use the search field to find all records of the website.
Switch from the “Today” filter to “History” to see all records of that site.
Use the keyboard shortcut Ctrl-A to select all entries.
Right-click on the selection and select “Delete pages”. Note that there is no confirmation.

What about other records?

Deleting a site from the browsing history removes records of visits only from this database. Other databases may still store information about the site. There is the downloads history, which may have records if you downloaded files from the site.

Sites may also place content on the computer, e.g., as cookies or site data. These do not get cleared when you delete the browsing history.

How to delete other site records in Chrome and other Chromium-based browsers

It is relatively easy to delete site data and cookies in Google Chrome and other Chromium-based browsers.

Select Menu > Settings in the web browser.
Open Privacy and Security.
Select Site settings on the page that opens.
Click on “View permissions and data stored across sites”.
Use the search at the top to find a site.
Click on the trashcan icon next to it to remove it.
Confirm the operation with a click on the delete button.

Note: this removes offline data and logs you out of the site.

Do the following to remove the downloads history in the browser:

Load chrome://downloads/ in the browser’s address bar.
Use the search at the top to find all records of a site.
Activate the x-icon next to each to remove the records.

Deleting site records in Mozilla Firefox

You may also remove cookies and site data records in Mozilla Firefox.

Load about:preferences#privacy in the Firefox address bar. This opens the Privacy preferences.
Scroll down to the Cookies and Site Data section.
Activate the “Manage Data…” button there,
Use the search field at the top to find a specific website.
Click “remove all shown”. Firefox deletes the entry immediately without confirmation.

Here are the steps to clear all downloads from a specific site:

Select Menu > Downloads or use the keyboard shortcut Ctrl-J to open the Downloads interface.
Use the search at the top to find downloads from a specific site.
Use Ctlr-A to select all downloads.
Press the Delete key to remove all entries from Firefox’s history.