ilias :thepiratebay:

2 months ago (Received 1 month ago) • •

ilias :thepiratebay:
2 months ago (Received 1 month ago) • •

+1 reason why you must stop using Chrome and, if possible, Chromium browsers

(Upd: link to a post in Fediverse with tech details https://fedi.simonwillison.net/@simon/112757810519145581)

(Upd 2: MS Edge seems to have this issue; #Vivaldi also has it but it can be disabled; Ungoogled Chromium doesn't have it at all)

#Privacy #Tech #Technology #Browser #Chrome #Chromium #Firefox #Google #BigTech

Luca Casonato (@lcasdev):

So, Google Chrome gives all *.google.com sites full access to system / tab CPU usage, GPU usage, and memory usage. It also gives access to detailed processor information, and provides a logging backchannel. This API is not exposed to other sites - only to *.google.com.

This is interesting because it is a clear violation of the idea that browser vendors should not give preference to their websites over anyone elses. The DMA codifies this idea into law: browser vendors, as gatekeepers of the internet, must give the same capabilities to everyone

Depending on how you interpret the DMA, this additional exposure of information only to Google properties may be considered a violation of the DMA. Take for example Zoom - they are now at a disadvantage because they can not provide the same CPU debugging feature as Google Meet

For those interested: this is done through a built-in Chrome extension that can not be disabled, and does not show up in the extensions panel. Source code is here: https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/resources/hangout_services/ It is unclear whether the same extension also ships in other Chromium derived browsers

Simon Willison

2024-07-09 17:54:05

It turns out Google Chrome ships a default, hidden extension that allows code on `*.google.com` access to private APIs, including your current CPU usage
You can test it out by pasting the following into your Chrome DevTools console on any Google page:
chrome.runtime.sendMessage(
"nkeimhogjdpnpccoofpliimaahmaaome",
{ method: "cpu.getInfo" },
(response) => {
console.log(JSON.stringify(response, null, 2));
},
);
More notes here: https://simonwillison.net/2024/Jul/9/hangout_servicesthunkjs/

hangout_services/thunk.js
It turns out Google Chrome (via Chromium) includes a default extension which makes extra services available to code running on the `*.google.com` domains - tweeted about today [by Luca Casonato](https://twitter.
^{simonwillison.net}