Re:An iframe from googlesyndication.com tries to access the ...
by d0gbread on Sunday December 19, 2021 @02:09PM
(#29617190)
I thought they meant more like sandbox environment. Why would the API to access those things exist at all?
Re:An iframe from googlesyndication.com tries to access the ...
by jimbojet on Sunday December 19, 2021 @02:17PM
(#29617285)
The API exists because zoom.com request microphone and camera through an iframe is a legit use case. As OP said below CSPs exist so that enterprises can lock down those vulnerabilities. But wouldn’t make sense to lock it down for all consumers.
What if bad actors figured out a way to identify google's emulators and avoid doing bad stuff in that situation?
The part i said "google develops browser solutions to prevent issues like this" is exactly what features policy will end up doing. But google's ad systems and chrome features don't always move at the same speed, but you can be sure that whatever ad malware team is finding will help chrome team to strengthen their defense.