Google Chrome Sync Feature Abused by Cyberstalkers for Espionage
Cyberstalkers are exploiting Google Chrome's sync feature to gain unauthorized access to users' browsing history and stored passwords, researchers warn.
Security researchers have identified a concerning trend where cyberstalkers are weaponizing Google Chrome's legitimate sync feature to spy on unsuspecting users. Certo Software detailed in a recent blog post how attackers can leverage this convenience function, designed to seamlessly synchronize data across devices, to access a victim's sensitive browsing information and credentials.
The method involves an attacker gaining brief physical access to a victim's phone. During this window, they can log into their own Google account via the Chrome browser. Once logged in and with the sync feature enabled, all browsing history and saved passwords from the victim's device are automatically mirrored to the attacker's account. This allows the stalker to monitor the victim's online activities and potentially access accounts protected by stolen credentials from anywhere in the world.
Certo Software highlighted the severity of this abuse through a case study of a victim named Emma. Emma had meticulously used her own devices and believed her online activities were private. However, an attacker, having briefly accessed her phone while she slept, had previously signed into his Google account on her Chrome browser. Consequently, his account began receiving copies of her browsing history, including searches for sensitive topics like domestic violence support, which he later used to confront her.
Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, commented that this research underscores a critical point: not all tech-enabled abuse relies on sophisticated stalkerware. This method exploits a built-in, legitimate feature, making it harder to detect than traditional spyware, which often requires installation, suspicious permissions, or causes noticeable battery drain.
Certo Software has proposed potential mitigations for Google to implement. These include introducing temporary notifications whenever a new account is added to Chrome or when the sync feature is activated. Additionally, a persistent, visible indicator showing when sync is active and which account it is connected to could alert users to potential misuse.
Google has not yet responded to requests for comment regarding these findings. However, researchers suggest that the rise in this particular abuse vector might be a consequence of increased security measures making traditional spyware more difficult to deploy. Modern smartphones are more secure than ever, with regular updates and stricter app store policies making it riskier for attackers to install malicious software.
This exploitation of Chrome's sync feature is not the first time security concerns have been raised about the browser's synchronization capabilities. Given Chrome's status as the world's most popular browser, any vulnerability or potential for abuse within its core features carries significant implications for user privacy and security on a global scale.