Google Chrome has come under fire for the second time in under three months and this time around it is for the caching method it employs which leaves users vulnerable to data theft.
According to Identity Finder, a data management firm, Chrome’s caching mechanism stores personal information such as names, email addresses, phone numbers, social security numbers, street addresses, credit card numbers and other such sensitive information directly onto the hard drive of users’ computers without consent and that too in plain text.
The vulnerability comes into play when a user keys in any of the above mentioned information into a webform or other trusted sites while using Chrome. Google Chrome stores this information into its browser cache in plain text to automatically suggest it to users during later use. But, this is in stark contrast to what browser cache as supposed to do. A browser cache is ideally used to store media files and other web documents onto a user’s local system to speed up the display of web pages on his / her next visit.
According to Identity Finder, an attacker may be able to install a malware which can easily access Chrome’s browser cache and extract private and sensitive information. The firm carried out tests in its own infrastructure and found that even though its employees “entered this information on secure websites, Chrome saved copies of this data in the History Provider Cache.”
“Other SQLite databases of interest include “Web Data” and “History.” On Windows machines, these files are located at %localappdata%\Google\Chrome\User Data\Default\”, the company added.
Identify Finder has also created a small proof-of-concept code that extracts sensitive information from the cache and offloads it to a third party site.
