Technology

59411 readers

3003 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related content.
Be excellent to each another!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, to ask if your bot can be added please contact us.
Check for duplicates before posting, duplicates may be removed

Approved Bots

founded 1 year ago

MODERATORS

1532

Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage (fedi.simonwillison.net)

submitted 4 months ago* (last edited 4 months ago) by [email protected] to c/technology

199 comments fedilink hide all child comments

cross-posted from: https://lemmy.dbzer0.com/post/23752739

https://simonwillison.net/2024/Jul/9/hangout_servicesthunkjs/

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 59 points 4 months ago* (last edited 4 months ago) (1 children)

There's a bunch of stuff in Chrome that's special-cased to only allow Google to access it.

Not sure if it's still there, but many years ago I was trying to figure out how to do something that some Google webapp was doing (can't remember which one). I think it was something to do with popping up a chromeless window - that is, a new window with no address bar or browser chrome, just some HTML content.

Turns out the Chromium codebase had a hard-coded allowlist that only allowed *.google.com to use the API!

Edit: my memory was a bit wrong. It was this: https://stackoverflow.com/a/11614605. The Hangouts extension was allowlisted to use the functionality, but if any other extension wanted to use it, the user had to enable an experimental setting.

[–] [email protected] 9 points 4 months ago (2 children)

Are you talking about the "apps" that Chrome used to support? They removed the feature years ago to reduce bloat and RAM usage or something like that.

Before they removed the feature, I had actually figured out how to create my own "apps" that'd simply load webpages I visited often at the time, like Twitch.

[–] [email protected] 5 points 4 months ago* (last edited 4 months ago)

I found what I was talking about: https://stackoverflow.com/a/11614605. It was a feature that the Hangouts extension could use, but the user had to manually enable it in the browser settings for any other extensions to use it.

The apps feature is still there just with a different name. It's labeled as "create shortcut", and you have to check the box to open a new window. I use it just because Firefox doesn't have a similar feature.

[–] QuantumStorm 5 points 4 months ago

I don't know why, but my head automatically put that as "the apps formerly support by Google" the same as "the artist formerly known as Prince"