Deep Dive into Site Isolation (Part 2)
Posted Dec 28, 2020 2020-12-28T09:25:00-08:00 by Jun Kokatsu In the previous blog post, I explained how Site Isolation and related security features help mitigate attacks such as UXSS and Spectre. However, security bugs in a renderer process are really common, and therefore Chromium’s threat model assumes that a renderer process can be compromised and it can’t be trusted. To align with this threat
Securing your extensions against compromised renderer processes
Chrome has introduced Site Isolation to make it harder for malicious web pages to steal data from the user's other web accounts, even if an attacker uses a Chrome security bug to compromise a renderer process. This greatly improves security for Chrome users, but it is possible for security issues in extensions to erode some of this protection.
Guidance to developers affected by our effort to block less secure browsers and applications- Google Developers Blog
Guidance to developers affected by our effort to block less secure browsers and applications Share Facebook Twitter LinkedIn Mail Posted by Lillan Marie Agerup, Product Manager We are always working to improve security protections of Google accounts. Our security systems automatically detect, alert and help protect our users against a range of security threats. One form of phishing, known as “man-
Deep Dive into Site Isolation (Part 1)
Posted Nov 10, 2020 2020-11-10T10:00:00-08:00 by Jun Kokatsu Back in 2018, Chrome enabled Site Isolation by default, which mitigates attacks such as UXSS and Spectre. At the time, I was actively participating in the Chrome Vulnerability Reward Program, and I was able to find 10+ bugs in Site Isolation, resulting in $32k rewards. In this blog post series, I will explain how Site Isolation and relat
Protect your resources from web attacks with Fetch Metadata | Articles | web.dev
Protect your resources from web attacks with Fetch Metadata Stay organized with collections Save and categorize content based on your preferences. Why should you care about isolating your web resources? Many web applications are vulnerable to cross-origin attacks like cross-site request forgery (CSRF), cross-site script inclusion (XSSI), timing attacks, cross-origin information leaks or speculativ
A new default Referrer-Policy for Chrome - strict-origin-when-cross-origin | Blog | Chrome for Developers
Before we start: If you're unsure of the difference between "site" and "origin", check out Understanding "same-site" and "same-origin". The Referer header is missing an R, due to an original misspelling in the spec. The Referrer-Policy header and referrer in JavaScript and the DOM are spelled correctly. Summary Browsers are evolving towards privacy-enhancing default referrer policies, to provide a
Resuming SameSite Cookie Changes in July
$200K 1 10th birthday 4 abusive ads 1 abusive notifications 2 accessibility 3 ad blockers 1 ad blocking 2 advanced capabilities 1 android 2 anti abuse 1 anti-deception 1 background periodic sync 1 badging 1 benchmarks 1 beta 83 better ads standards 1 billing 1 birthday 4 blink 2 browser 2 browser interoperability 1 bundles 1 capabilities 6 capable web 1 cds 1 cds18 2 cds2018 1 chrome 35 chrome 81
A safer and more private browsing experience with Secure DNS
$200K 1 10th birthday 4 abusive ads 1 abusive notifications 2 accessibility 3 ad blockers 1 ad blocking 2 advanced capabilities 1 android 2 anti abuse 1 anti-deception 1 background periodic sync 1 badging 1 benchmarks 1 beta 83 better ads standards 1 billing 1 birthday 4 blink 2 browser 2 browser interoperability 1 bundles 1 capabilities 6 capable web 1 cds 1 cds18 2 cds2018 1 chrome 35 chrome 81
COOP and COEP explained
COOP and COEP explained 共有ログインお使いのブラウザのバージョンはサポートが終了しました。 サポートされているブラウザにアップグレードしてください。閉じる ファイル編集表示ツールヘルプユーザー補助機能デバッグ
Making your website "cross-origin isolated" using COOP and COEP | Articles | web.dev
The cross-origin isolated state also prevents modifications of document.domain. (Being able to alter document.domain allows communication between same-site documents and has been considered a loophole in the same-origin policy.) To opt in to a cross-origin isolated state, you need to send the following HTTP headers on the main document: Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opene
電子情報学特論：Chromiumのアーキテクチャを解き明かす
電子情報学特論： Chromium のアーキテクチャを解き明かす 〜 EEIC の授業が生きるプロダクトの世界〜 Kentaro Hara 2020 April (๑>ᴗ<๑) * * * *
SameSite Updates
Confused? Start here. Developers: Check out our testing and debugging tips. Adding `SameSite=None; Secure` to your cookies? Check the list of incompatible clients here. Check the list of Frequently Asked Questions (FAQ) for common scenarios and use cases. Launch Timeline Last updated Mar 18, 2021. Latest update: Mar 18, 2021: The flags #same-site-by-default-cookies and #cookies-without-same-site-m
Temporarily rolling back SameSite Cookie Changes
$200K 1 10th birthday 4 abusive ads 1 abusive notifications 2 accessibility 3 ad blockers 1 ad blocking 2 advanced capabilities 1 android 2 anti abuse 1 anti-deception 1 background periodic sync 1 badging 1 benchmarks 1 beta 83 better ads standards 1 billing 1 birthday 4 blink 2 browser 2 browser interoperability 1 bundles 1 capabilities 6 capable web 1 cds 1 cds18 2 cds2018 1 chrome 35 chrome 81
Upcoming Browser Behavior Changes: What Developers Need to Know
Browser ChangesUpcoming Browser Behavior Changes: What Developers Need to KnowLearn about upcoming changes to browser cookie behavior that may make your web applications incompatible. Are you operating a web application with sessions (e.g. for saving user preferences, shopping carts)? Do you allow users to sign in using identity providers such as Google and Apple, or use solutions such as Auth0? W
Google Chrome portal element fuzzing
Background Some time ago, while browsing my Twitter feed I stumbled upon an interesting tweet from Michał Bentkowski [https://twitter.com/SecurityMB/status/1127963181089992705]. The description of the new portal element certainly grabbed my attention as something that may have an impact on security. You can learn more about the portal element from here [https://web.dev/hands-on-portals] and here [
Same-Site Cookies By Default
text/plain ericlaw talks about security, the web, and software in general The Chrome team is embarking on a clever and bold plan to change the recipe for cookies. It’s one of the most consequential changes to the web platform in almost a decade, but with any luck, users won’t notice anything has changed. But if you’re a web developer, you should start testing your sites and services now to help en
CSRF is (really) dead
Scott Helme Security researcher, entrepreneur and international speaker who specialises in web technologies. More posts by Scott Helme. A little while back I wrote a blog post about how "CSRF is dead". It focused on SameSite cookies, a powerful yet simple feature to protect your website against CSRF attacks. As powerful as it was, and as much as it will kill CSRF, you had to enable it on your site
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Schemeful Same-Site | Articles | web.dev
Intent to Ship: cross-origin isolation
Multi-Origin Trusted Web Activities | Web on Android | Chrome for Developers