Google Chrome Wants to Block 'Bad' Websites from Infecting Connected Devices With This Feature

In a bid to enhance user security, Google Chrome is experimenting with a groundbreaking feature aimed at thwarting malicious websites' attempts to exploit vulnerabilities within users' internal networks.

Enhanced Protection Against Malicious Websites

Google's initiative revolves around shielding users from potential cyber threats posed by malicious websites attempting to breach devices and services within their private networks. This proactive measure seeks to fortify the defense mechanisms against attacks orchestrated through users' browsers.

Preventing Unauthorized Access to Internal Devices

The proposed feature, termed "Private Network Access protections," will initially operate in a "warning-only" mode within Chrome 123. It functions by scrutinizing requests made by public websites (referred to as "site A") before navigating to other sites (referred to as "site B") within the user's private network.

Strategic Checks and Verification

These checks entail evaluating the request's origin and dispatching a preliminary inquiry to ascertain site B's accessibility from public websites via CORS-preflight requests.

Unlike existing safeguards targeting subresources and workers, this feature is specifically tailored to address navigation requests, prioritizing the safeguarding of users' private networks from potential intrusions.

According to Bleeping Computer, the automatic reload will push through even though Google's request is blocked. You can see this when there's internal => internal connection.

Furthermore, Google warns that since the feature is leaning more toward protecting private networks, the Private Network Access feature will not work. This is why the search engine giant plans to block page auto-reloading.

Later, you will see that the error message will pop out. This means that the page cannot be loaded because the Private Network Access did not allow it.

Implementation and Response Protocol

Under the proposed protocol, when a public site endeavors to connect with an internal device, the browser initiates a preflight request to the device. Subsequently, based on the device's response, conveyed through an "Access-Control-Request-Private-Network" header, the browser determines whether to permit the connection.

Notably, during the warning stage, failed checks prompt a warning in the DevTools console, affording developers an adjustment window before stricter enforcement ensues.

Upgraded Security Protection For Chrome Users

This innovative security upgrade aims to mitigate risks stemming from "SOHO Pharming" attacks and Cross-Site Request Forgery (CSRF) vulnerabilities.

By fortifying defenses against unauthorized access to routers and software interfaces on local devices, Google endeavors to elevate user safety standards amidst evolving cyber threats.

While the immediate focus remains on addressing external threats to private networks, the company envisions broader implications for integrating public and non-public resources securely. However, the current specification does not encompass securing HTTPS connections for local services, signifying potential avenues for future enhancements in safeguarding user data and network integrity.