Beehaw
  • Communities
  • Create Post
  • search
    Search
  • Login
  • Sign Up
Andromxda 🇺🇦🇵🇸🇹🇼 ( Andromxda@lemmy.dbzer0.com )  to TechnologyEnglish · 2 years ago

Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

fedi.simonwillison.net

external-link
message-square
13
link
fedilink
  • cross-posted to:
  • google@lemmy.ml
  • technology@lemmy.zip
202
external-link

Google Chrome ships a default, hidden extension that allows code on *.google.com access to private APIs, including your current CPU usage

fedi.simonwillison.net

Andromxda 🇺🇦🇵🇸🇹🇼 ( Andromxda@lemmy.dbzer0.com )  to TechnologyEnglish · 2 years ago
message-square
13
link
fedilink
  • cross-posted to:
  • google@lemmy.ml
  • technology@lemmy.zip
Simon Willison (@simon@simonwillison.net)
fedi.simonwillison.net
external-link
It turns out Google Chrome ships a default, hidden extension that allows code on `*.google.com` access to private APIs, including your current CPU usage You can test it out by pasting the following into your Chrome DevTools console on any Google page: chrome.runtime.sendMessage( "nkeimhogjdpnpccoofpliimaahmaaome", { method: "cpu.getInfo" }, (response) => { console.log(JSON.stringify(response, null, 2)); }, ); More notes here: https://simonwillison.net/2024/Jul/9/hangout_servicesthunkjs/

https://simonwillison.net/2024/Jul/9/hangout_servicesthunkjs/

alert-triangle
You must log in or register to comment.
  • boonhet ( boonhet@lemm.ee ) 
    link
    fedilink
    arrow-up
    66
    ·
    2 years ago

    Chrome cryptominer when

    • Pechente ( Pechente@feddit.org ) 
      link
      fedilink
      English
      arrow-up
      57
      ·
      2 years ago

      Probably already installed. That would at least explain the high resource usage of chrome

    • AlexWIWA ( AlexWIWA@lemmy.ml ) 
      link
      fedilink
      English
      arrow-up
      44
      ·
      2 years ago

      I’m willing to be we’ll see something to train language models on the user’s hardware soon enough. Folding at home, but instead of helping science, Google steals your electricity.

      • vvv ( vvv@programming.dev ) 
        link
        fedilink
        arrow-up
        14
        ·
        2 years ago

        I really think that’s the secret end game behind all the AI stuff in both Windows and MacOS. MS account required to use it. (anyone know if you need to be signed in to apple ID for apple ai?) “on device” inference that sometimes will reach out to the cloud. when it feels like it. maybe sometimes the cloud will reach out to you and ask your cpu to help out with training.

        that, and better local content analysis. “no we aren’t sending everything the microphone picks up to our servers, of course not. just the transcript that your local stt model made of it, you won’t even notice the bandwidth!)”

    • zqwzzle ( zqwzzle@lemmy.ca ) 
      link
      fedilink
      English
      arrow-up
      25
      ·
      2 years ago

      The shitty reboot of Office Space where some low level Google employee realizes they can stick a crypto miner in every browser and generate a couple cents from everyone’s browser.

      • Tolookah ( Tolookah@discuss.tchncs.de ) 
        link
        fedilink
        arrow-up
        16
        ·
        2 years ago

        G Suite Space?

  • abbadon420 ( abbadon420@lemm.ee ) 
    link
    fedilink
    arrow-up
    13
    ·
    2 years ago

    Here’s the plan. You write an extension for chrome that makes chrome think all traffic from [cryptominingcentral.com] is actually from *.google.com. Make folks install the plugin via the tried and tested methods like phishing. … profit

    • authorinthedark ( authorinthedark@lemmy.sdf.org ) 
      link
      fedilink
      English
      arrow-up
      13
      ·
      2 years ago

      couldn’t you do that anyway if you can get people to install an extension? taking advantage of this for crypto mining purposes feels like extra steps

  • Hirom ( Hirom@beehaw.org ) 
    link
    fedilink
    arrow-up
    7
    ·
    2 years ago

    Cannot reproduce on chromium. Has anyone reproduced it?

    • BlueÆther ( BlueEther@no.lastname.nz ) 
      link
      fedilink
      arrow-up
      14
      ·
      2 years ago

      yeah:

      {
        "value": {
          "archName": "arm64",
          "features": [],
          "modelName": "Apple M2",
          "numOfProcessors": 8,
          "processors": [
            {
              "usage": {
                "idle": 10841460,
                "kernel": 611796,
                "total": 13342920,
                "user": 1889664
              }
            },...
      
    • Andromxda 🇺🇦🇵🇸🇹🇼 ( Andromxda@lemmy.dbzer0.com ) OP
      link
      fedilink
      English
      arrow-up
      10
      ·
      2 years ago

      Did you use normal chromium or Ungoogled Chromium? I tried it on the Arc Browser (which is based on Chromium), and it worked, but it didn’t work on Ungoogled Chromium.

      • Hirom ( Hirom@beehaw.org ) 
        link
        fedilink
        arrow-up
        4
        ·
        2 years ago

        Neither. I use a chromium package from my linux distribution.

        It has many patches on top of the upstream chromium. That probably explain why that unwanted feature isn’t there.

        This issue appear on Google Chrome for Windows on my other machine. Just uninstalled it, never used it anyway.

    • jherazob ( jherazob@beehaw.org ) 
      link
      fedilink
      arrow-up
      8
      ·
      2 years ago

      Reproduced here, Chromium on Linux Mint desktop. You need to have open a Google.com site for it to work though.

Technology

technology

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !technology@beehaw.org

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:

  • Free and Open Source Software
  • Programming
  • Operating Systems

This community’s icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 255 users / day
  • 780 users / week
  • 1.49K users / month
  • 4.8K users / 6 months
  • 5.11K local subscribers
  • 43.9K subscribers
  • 6.49K Posts
  • 108K Comments
  • Modlog
  • mods:
  • Chris Remington ( remington@beehaw.org ) 
  • alyaza [they/she] ( alyaza@beehaw.org ) 
  • TheRtRevKaiser ( TheRtRevKaiser@beehaw.org ) 
  • gyrfalcon ( gyrfalcon@beehaw.org ) 
  • rs5th ( rs5th@beehaw.org ) 
  • coldredlight ( coldredlight@beehaw.org ) 
  • Leigh ( SemioticStandard@beehaw.org ) 
  • TheRtRevKaiser ( TheRtRevKaiser@kbin.social ) 
  • BE: 0.19.21
  • Modlog
  • Legal
  • Instances
  • Docs
  • Code