Google Chrome has an API accesible only from *.google.com(twitter.com)
twitter.com
Google Chrome has an API accesible only from *.google.com
https://twitter.com/lcasdev/status/1810696257137959018
368 comments
I might be able to shed some light on this (disclaimer: Xoogler).
I worked for a time on Google's internal videoconferencing platform, called GVC. This was in 2010-2011 at a time when a lot of the company's VC equipment was proprietary, specifically Cisco Tandberg units. These were expensive and would be expensive to roll out to thousands of meeting rooms.
around this time a different team was developing Hangouts. It's been awhile so my memory may be off but I think it was called Google Meet at the time? or maybe that was later? It's hard to keep track. I think Hangouts was the name adopted when Google+ came along and rolled Hangouts into its product offering.
There were different configurations of GVC but the most common were these All-in-One ("AIO") monitor/computer combos. It was a full Intel PC. So the GVC platform was a custom Linux distro. The system was designed so GVCs could talk to Google services, which was nontrivial, and so software updates could be rolled out. It kept old distros too in case one didn't boot. These GVCs had to be named and a whole bunch of other issues.
Additionally they needed support for various hardware like a touch panel to dial. Larger units required larger PTZ camera support and support for various microphones.
Anyway, Hangouts became the stack GVC was built on. This ultimately replaced virtually all Tandbergs and saved a fortune. This system was certainly still in use by 2017. I can't speak for later.
Monitoring was a part of all this. So when I see there are *.google.com specific APIs, we need to be sure we're talking about this accurately. Like can Google query any Chrome instance in the world? Or is it only from/to google.com? I don't know the answer and the Tweet doesn't specify.
But given the name hangouts_services and the domain restriction I consider it highly likely this is purely to support monitoring embedded Chrome for GVC. I could be wrong.
I worked for a time on Google's internal videoconferencing platform, called GVC. This was in 2010-2011 at a time when a lot of the company's VC equipment was proprietary, specifically Cisco Tandberg units. These were expensive and would be expensive to roll out to thousands of meeting rooms.
around this time a different team was developing Hangouts. It's been awhile so my memory may be off but I think it was called Google Meet at the time? or maybe that was later? It's hard to keep track. I think Hangouts was the name adopted when Google+ came along and rolled Hangouts into its product offering.
There were different configurations of GVC but the most common were these All-in-One ("AIO") monitor/computer combos. It was a full Intel PC. So the GVC platform was a custom Linux distro. The system was designed so GVCs could talk to Google services, which was nontrivial, and so software updates could be rolled out. It kept old distros too in case one didn't boot. These GVCs had to be named and a whole bunch of other issues.
Additionally they needed support for various hardware like a touch panel to dial. Larger units required larger PTZ camera support and support for various microphones.
Anyway, Hangouts became the stack GVC was built on. This ultimately replaced virtually all Tandbergs and saved a fortune. This system was certainly still in use by 2017. I can't speak for later.
Monitoring was a part of all this. So when I see there are *.google.com specific APIs, we need to be sure we're talking about this accurately. Like can Google query any Chrome instance in the world? Or is it only from/to google.com? I don't know the answer and the Tweet doesn't specify.
But given the name hangouts_services and the domain restriction I consider it highly likely this is purely to support monitoring embedded Chrome for GVC. I could be wrong.
Looks like they added this in October 2013: https://github.com/chromium/chromium/commit/422c736b82e7ee76...
Bundle Hangouts Services extension with Chrome
BUG=291271
Review URL: https://codereview.chromium.org/35873003
I'm not sure what these APIs are exactly and why they're there, but Firefox also does something similar. It has special APIs available only to Mozilla and/or Firefox domains, for things like installing extensions, or helping with first-run experience.
A blog post about it was shared here on Hacker news <12 months ago, but I'm having trouble finding it...
A blog post about it was shared here on Hacker news <12 months ago, but I'm having trouble finding it...
Disclaimer: I work at Google, but not on Chrome or on these APIs.
I think the explanation is quite mundane. An example usage: open google meet, start an empty meeting (an “instant meeting”), click the “…” menu, click “troubleshooting and help”.
There’ll be plots of various stats, including CPU utilization. I think meet will also helpfully suggest closing tabs if your machine is overloaded during a meet call, too.
It’s very helpful, I check it from time to time.
Edit: now that I think about it, I’m not sure about the suggestion to close tabs is actually a thing. I’ve only actually used the stats view.
I think the explanation is quite mundane. An example usage: open google meet, start an empty meeting (an “instant meeting”), click the “…” menu, click “troubleshooting and help”.
There’ll be plots of various stats, including CPU utilization. I think meet will also helpfully suggest closing tabs if your machine is overloaded during a meet call, too.
It’s very helpful, I check it from time to time.
Edit: now that I think about it, I’m not sure about the suggestion to close tabs is actually a thing. I’ve only actually used the stats view.
I think the submission is a bit wrong in editing the title from the original. I understood it like this:
Chrome has a built-in extension that uses public Chrome APIs that are easily available to other Chrome extensions. The issue described is that this extension shares this information to Google's own domains when they're communicating with the extension, while other websites can't do this.
There's no "special hidden API".
Chrome has a built-in extension that uses public Chrome APIs that are easily available to other Chrome extensions. The issue described is that this extension shares this information to Google's own domains when they're communicating with the extension, while other websites can't do this.
There's no "special hidden API".
Looks like this is accessing "chrome.system.cpu" API, which any extension can access (given the "system.cpu" permissions).
https://developer.chrome.com/docs/extensions/reference/api/s...
You can see all the permissions requested by this extension here:
https://source.chromium.org/chromium/chromium/src/+/main:chr...
https://developer.chrome.com/docs/extensions/reference/api/s...
You can see all the permissions requested by this extension here:
https://source.chromium.org/chromium/chromium/src/+/main:chr...
Hardly surprising. This is very Google-like behavior. The question is do other Chromium browsers have this? Edge? Brave? Chromium? Ungoogled Chromium?
Safari also has some Apple specific features, like being able to show a special dialog for logging into other websites with your Apple account that works differently from passkeys or password autofill, or the redirect based flow they make other browsers go through.
Always wondered how it's implemented in JS. WebAuthn with proprietary arguments...?
Always wondered how it's implemented in JS. WebAuthn with proprietary arguments...?
Google has done this sort of thing before. My memory is fuzzy as to the details, but I think it was Native Client being allowlisted at the domain level to only work on Hangouts, or something like that.
I briefly worked on Internet Explorer in ages past. They would develop APIs with the Windows team for use in IE to give IE special features that other browsers couldn't implement.
So this is a lot like Microsoft using specialized formats or APIs in Windows that competitors cannot access, which was a problem throughout the 90s. The problem never went away - it has just changed appearance.
> So, Google Chrome gives all *.google.com sites full access to system / tab CPU usage, GPU usage, and memory usage. It also gives access to detailed processor information, and provides a logging backchannel.
So I guess the question becomes how quickly you can spoof this ?
So I guess the question becomes how quickly you can spoof this ?
This kind of thing is common, there was a file called tweaks.cpp which had a list of domains that had slightly different behaviours.
That file was very telling to be honest and was well commenter. Firefox has a similar file.
That file was very telling to be honest and was well commenter. Firefox has a similar file.
You can build Chrome without this by setting `enable_hangout_services_extension` to false. Of course, then none of the WebRTC stuff on google.com will work.
Is it fair to assume this is used for fingerprinting/tracking users?
I stopped using Chrome as my primary & only browser. Too much power in one hand?
If you want to see what this does, navigate to https://www.google.com/ in Chrome and paste this into your DevTools console:
chrome.runtime.sendMessage(
'nkeimhogjdpnpccoofpliimaahmaaome', {
method: 'cpu.getInfo'
}, response => {
console.log('CPU Info:\n', JSON.stringify(response, null, 2));
}
);
{
"value": {
"archName": "arm64",
"features": [],
"modelName": "Apple M2 Max",
"numOfProcessors": 12,
"processors": [
{
"usage": {
"idle": 26879793,
"kernel": 5270058,
"total": 42511068,
"user": 10361217
}
},
{
"usage": {
"idle": 27925505,
"kernel": 5045974,
"total": 42900999,
"user": 9929520
}
},
{
"usage": {
"idle": 29153545,
"kernel": 4688719,
"total": 43152989,
"user": 9310725
}
},
{
"usage": {
"idle": 30140852,
"kernel": 4360719,
"total": 43319960,
"user": 8818389
}
},
{
"usage": {
"idle": 34426211,
"kernel": 2169516,
"total": 43433582,
"user": 6837855
}
},
{
"usage": {
"idle": 38586206,
"kernel": 1338183,
"total": 43658789,
"user": 3734400
}
},
{
"usage": {
"idle": 41067872,
"kernel": 598226,
"total": 43874597,
"user": 2208499
}
},
{
"usage": {
"idle": 41795321,
"kernel": 412479,
"total": 43965499,
"user": 1757699
}
},
{
"usage": {
"idle": 34484688,
"kernel": 2180147,
"total": 43500079,
"user": 6835244
}
},
{
"usage": {
"idle": 38604714,
"kernel": 1340358,
"total": 43680869,
"user": 3735797
}
},
{
"usage": {
"idle": 41086212,
"kernel": 599273,
"total": 43883401,
"user": 2197916
}
},
{
"usage": {
"idle": 41802500,
"kernel": 411499,
"total": 43970596,
"user": 1756597
}
}
],
"temperatures": []
}
}
If it's really accessible from *.google.com, wouldn't this be simple to verify/exploit by using Google Sites (they publish your site to sites.google.com/view/<sitename>)?
And this is why we should all boycott Chromium based browsers.
It's turning (and mostly has already turned) into the new Internet Explorer.
Use Safari or Firefox, or any other browser that's not based on Chromium.
It's turning (and mostly has already turned) into the new Internet Explorer.
Use Safari or Firefox, or any other browser that's not based on Chromium.
Google spent billions muscling their way into their majority market share of web browsers, now they're going to keep on cashing out with unfair practices like these.
If you’re still using Chrome in 2024, you’re a fool.
Last time I used Google Chrome, if you logged into a Google account while using Chrome, it automatically logged you into that Google account in the browser itself.
Isn't that implemented in a similar way to this?
I agree with the concerns about unfair competition, and I think this auto-login "feature" could also qualify as an example.
Isn't that implemented in a similar way to this?
I agree with the concerns about unfair competition, and I think this auto-login "feature" could also qualify as an example.
Thread reader: https://twitter-thread.com/t/1810696257137959018
Isn't Google chrome open source?
It should be possible to point to the source code of whatever google.com extensions that may exist.
Or is this only available in the packaged distributions of Chrome?
It should be possible to point to the source code of whatever google.com extensions that may exist.
Or is this only available in the packaged distributions of Chrome?
Is there more of an explanation? I see a baseless claim without any specificity.
I'm not saying it's right/wrong, just that no evidence was presented.
I'm not saying it's right/wrong, just that no evidence was presented.
through this, at least it is now fairly well known that chrome is able to share detailed hardware details to a website.
now, is it bad that it is being done at all or that only google.com host requests can access it?
personally i see the value during debugging but having it forced enabled this way (also for only one company) is not great and should be remedied.
now, is it bad that it is being done at all or that only google.com host requests can access it?
personally i see the value during debugging but having it forced enabled this way (also for only one company) is not great and should be remedied.
This API either shouldn’t exist or should be Google only. It would be an absolute disaster if everyone had access to it.
[deleted]
It's like Google relishes in giving the FTC all the help it could ever want.
My guess is that Google will react to this Twitter thread by simply deleting it. Hangouts has been a dead product for a while; if their server side code still uses it they can surely remove it as presumably the Chrome team monitor WebRTC performance themselves in a multi-site way now, given the much wider usage.