Security News > 2020 > August > Google Chrome Browser Bug Exposes Billions of Users to Data Theft

The bug is found in Chrome, Opera and Edge, on Windows, Mac and Android - potentially affecting billions of web users, according to PerimeterX cybersecurity researcher Gal Weizman.

CSP allows web admins to specify the domains that a browser should consider to be valid sources of executable scripts.

"CSP is the primary method used by website owners to enforce data-security policies to prevent malicious shadow-code executions on their website, so when browser enforcement can be bypassed, personal user data is at risk," Weizman explained, in research released on Monday.

"In a similar way, website developers may allow third-party scripts to add functionality to their payment page, for example, knowing that CSP will restrict access to sensitive information. So, when CSP is broken, the risk for sites that relied on it is potentially higher than it would have been if the site never had CSP to begin with."

The vulnerability was present in Chrome browsers for more than a year before being fixed, so Weizman warned that the full implications of the bug are not yet known: "It is highly likely that we will learn of data breaches in the coming months that exploited it and resulted in the exfiltration of personally identifiable information for nefarious purposes."

News URL

https://threatpost.com/google-chrome-bug-data-theft/158217/