- A UX feature that helps users determine what connections they have visited in the past can be abused
- Over the years there were several attempts to solve it
- Google claims that the next version of Chrome finally addresses it
Google finally attaches a vulnerability in Chrome that has been present since its inception, which could be used to spy on people’s browsing habits.
In a blog post published in early April, Google’s Kyra Seevers explained that when a person clicks on a link displayed on a webpage, it becomes from blue to purple. The idea behind this design was to improve the user experience and help people navigate the web more easily. This state change is handled by CSS.
However, malicious actors found different ways to abuse this UX feature to spy on people’s browser habits. For example, a malicious site may contain thousands of links to popular sites, but style them in a way that visitors do not actually see them. The site then uses JavaScript or CSS to check which of these links to view purple and effectively learn which places the victim has already visited.
Chrome 136 to rescue
Apparently, the problem is not limited to Chrome, but is instead present on most browsers these days. In fact, the problem is previous for the Chrome browser, which was first introduced in 2008.
“These attacks can reveal what connections a user has visited and delicious details about their web browsing activity,” Seeever explained. “This security problem has been plaguing the Internet for over 20 years, and browsers have inserted various stop gaps to mitigate these historic detection attacks. While the attacks are slowed down by these diminings, they are not removed.”
However, the next version of the browser, Chrome 136, must “reproduce these attacks outdated.” This is achieved by division: Visited Link History, Seevers said further.
We are not bored with the technicalities of the solution, but if you are interested in reading them, be sure to check SEEVER’s blog here.
Chrome 136 is scheduled for release at the end of April 2025.
Via Registered
