Google on Thursday announced that it will soon block login attempts from embedded browser frameworks in an effort to prevent man-in-the-middle (MitM) phishing attacks.
The tech giant says phishing attacks that involve traffic interception are difficult to detect when an embedded browser framework or a different type of automation platform is used for authentication.
As an example of an embedded browser framework Google provided its Chromium Embedded Framework (CEF), which is designed for embedding Chromium-based browsers in other applications.
Since its systems can’t make the difference between legitimate logins and MitM attacks when such frameworks are used, Google has decided that, starting with June, it will block sign-ins from these frameworks.
The company says this latest move is similar to webview sign-in restrictions announced in April 2016.
“The solution for developers currently using CEF for authentication is the same: browser-based OAuth authentication. Aside from being secure, it also enables users to see the full URL of the page where they are entering their credentials, reinforcing good anti-phishing practices,” said Jonathan Skelker, Product Manager of Account Security at Google.
These measures come after last year Google informed users that they must enable JavaScript in their web browser due to the introduction of a new security mechanism for the login process. Specifically, when the username and password are entered on the sign-in page, a JavaScript-based risk assessment is conducted and authentication is only successful if nothing suspicious is detected.
Related: Google Boosts Android Security with Protected Confirmation
Related: Google Tightens OAuth Rules to Combat Phishing
Related: Google to Revoke OAuth 2.0 Tokens Upon Password Reset
Related: JavaScript Library Introduced XSS Flaw in Google Search
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- NIST Publishes Final Version of 800-82r3 OT Security Guide
- Johnson Controls Hit by Ransomware
- Verisoul Raises $3.25 Million in Seed Funding to Detect Fake Users
- Government Shutdown Could Bench 80% of CISA Staff
- Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor
- macOS 14 Sonoma Patches 60 Vulnerabilities
- New GPU Side-Channel Attack Allows Malicious Websites to Steal Data
Latest News
- National Security Agency is Starting an Artificial Intelligence Security Center
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
- Cloudflare Users Exposed to Attacks Launched From Within Cloudflare: Researchers
- A Key US Government Surveillance Tool Should Face New Limits, a Divided Privacy Oversight Board Says
- NIST Publishes Final Version of 800-82r3 OT Security Guide
- FBI Warns Organizations of Dual Ransomware, Wiper Attacks
- Johnson Controls Hit by Ransomware
