Browser AutoFill Feature Can Leak Your Personal Information to Hackers

Just like most of you, I too really hate filling out web forms, especially on mobile devices.

To help make this whole process faster, Google Chrome and other major browsers offer "Autofill" feature that automatically fills out web form based on data you have previously entered in similar fields.

However, it turns out that an attacker can use this autofill feature against you and trick you

Google Chrome will Start Blocking Flash by Default

Google Chrome Stop Support to Adobe Flash Player

Chrome browser of Google will stop its support to Adobe’s Flash Player on almost all websites by the end of this year. Staff member, Anthony LaForge while posting to Google groups, had defined the plan of the company to stop automatically permitting Flash to run on websites. The plan intended to be implemented by the fourth quarter of 2016 would be seeing HTML5 replacing Flash as a much integrated media experience with quicker load times and less power consumption.

LaForge had mentioned that `if a site offers an HTML5 experience, this change would make that the main experience’. They will continue to ship Flash Player with Chrome and if a site really needs Flash, a prompt would be appearing at the top of the page when the user first tends to visit that site, providing the options of allowing it to run for that site. But the top ten website utilizing Flash would not have it disabled, according to Google. Presently the ten biggest website as per Google are Amazon, YouTube, Facebook, V.K.com, Yahoo, Live.com, Yandex.rv, OK.ru, Twitch.tv and Mail.ru, though these may be changing towards the end of the year.

Proposal Document Outlining Change

Whitelisted websites would be having their Flash use secured for a year though it will also be reviewed during a period of 12 months. Proposal document outlining how the change would take place had been online by LaForge:

• Flash would still be bundled with Chrome though would not be advertised by default 
• If HTML5 is provided by a website, Chrome would automatically default to it 
• If Flash Player is essential, a user would be prompted 
• When a user accepts the page will get refreshed and Flash will appear on any following visits to the domain

Latest Backlash against Adobe Flash

The move is said to be the latest in on-going backlash against Adobe Flash and the platform was used to create animations, web pages as well as games from the early 2000s. However, it has been slowly replaced with more open web standards. Adobe had said, in November, that it was time for developers to move away from using Flash. The company had mentioned in a blog post that they encourage content creators to build with new web standards and would continue to focus on offering the best tools and services for designers as well as developers in creating amazing content for the web.

In July 2015, Mozilla had blocked all the versions of Flash in its Firefox browser. During the time Mozilla had said that Flash would stay blocked till Adobe releases a version which was not being actively exploited by publicly known susceptibilities and the block had been lifted few days thereafter. The death of Flash had been slow and painful with Google now planning to deal with another blow.

Google has plans to begin blocking most of Flash content with Chrome and the changeover is targeted to the end of the year. Under its existing vision, almost every website would be having Flash content blocked by default and visitors will still be capable of enabling Flash content on a site-by-site basis though would have to specially opt to do so. Flash has been a threat on battery life and is constantly found to have severe security errors and hence its ultimate disappearance would be accepted.

Chrome for Android vulnerability Discovered by Researcher

Chinese Researcher Discovered Susceptibilities in Android Operating System

Google, over the past few months had been busy crushing security susceptibilities in its prevalent Android mobile operating system, though several tends to remain undiscovered and some could be easily misused. Guang Gong, a Chinese researcher from Qihoo 360, demonstrated at MobilPwn2Own at the PacSec conference in Tokyo on how an Android device running the latest version of the operating system could be hijacked by exploiting JavaScript v8 vulnerability through Chrome browser.

 Gong observed JavaScript v8 susceptibility in Chrome for Android enabled him to install a random application on the affected device, a BMX Bike game in this case, without the need of user interaction. Dragos Ruiu, PacSec organizer had explained in a Google+ post. V8 is Google’s open source JavaScript engine and V8 is written in C++, used in Google Chrome which is the open source browser from Google.

Google security engineer on site had received the bug. Spotpedia had informed that `a Google engineer instantly got in touch with Gong after his presentation and rumours were on that the Chrome team had already got it fixed. Gong had commented on 9to5Google that the exploit was created by someone whose job was to find vulnerabilities and not a hacker with malicious intentions.

Vulnerability in JavaScript Engine in Chrome

As long as Chrome is utilised in navigating to a malicious site an attacker has set up, the device could be infected.This was demonstrated on a Google Project Fi Nexus 6 operating the latest Android 6.0 Marshmallow build with all applications updated. The vulnerability was also demonstrated by the researcher which could provide an attacker with total control of the device and success of the exploitation does not need chaining in multiple susceptibilities.

Ruiu informs that this particular shot exploit had been exposed after three months of work, though the exact details on the security flaw had not been publicly known. The exploit had been tested on other devices too and worked on all of them, according to Ruiu.Considering that the vulnerability is in the JavaScript engine in Chrome, it is said to affect the entire Android version with the new version of the browser which is installed. Ruiu had announced through Twitter that the details on the vulnerability had been handed over to Chrome engineer at the conference.

Series of Critical Android Vulnerabilities Observed

However, unfortunately for Gong, his presentation at the conference did not gain him an immediate reward for his efforts though probably Google would reward him for the discovery of the vulnerability, since the company has a bug bounty program set up for Chrome and Chrome OS. According to The Register, Ruiu would fly Gong to the CanSecWest security conference next year.

Google would most probably handle this vulnerability soon, even though the details on the exploit have not been made public so far. A series of critical Android vulnerabilities have been discovered by security researchers this year comprising of the Stagefright flaw which has affected almost a billion devices and a Stagefright2issue alleged to have affected devices running all Android version, began with the initial release.