Google is working on a new Unrestricted WebUSB feature, which allows trusted isolated web apps to bypass security restrictions in the WebUSB API. WebUSB is a JavaScript API that allows web applications to access local USB devices on a computer.
As part of the WebUSB specification, there are certain interface classes that are protected from being accessed via web applications to prevent malicious scripts from accessing potentially sensitive data.
The list of protected interface classes are audio, HID, mass storage, smart card, video, audio/video Devices, and wireless controller.
The WebUSB specification includes a block list of specific USB devices that cannot be accessed by the API, such as YubiKeys, Google Titan keys, and Feitian security keys, which are used for multi-factor authentication.
Isolated web apps are applications not hosted on live web servers but packaged into Web Bundles, signed by their developer, and distributed to end-users.
They are commonly created for companies to use in-house.
When an app with this permission attempts to access a USB device, the system first checks if it is on the blocklist of vulnerable devices.
If it is, the device is normally removed from the access list.
The system also checks whether the device is on the app's list of allowed devices.
The system will check if the accessed interface is marked as protected.
Google's proposed feature enables trusted isolated web apps to access a broader range of USB devices, allowing for greater functionality in a trusted setting.
Google says it plans to ship it for testing in Chome 128, which should be released in August 2024.
Chrome for Android tests feature that securely verifies your ID with sites.
Google Chrome reduced cookie requests to improve performance.
Google Chrome change that weakens ad blockers begins June 3rd. Google rolls out Chrome fix for empty pages when switching tabs.
Google fixes fifth Chrome zero-day exploited in attacks this year.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sun, 30 Jun 2024 21:20:21 +0000