Flaw in Chrome for iOS 7 Reveals Incognito Searches

Thursday October 3, 2013 10:32 AM PDT by Juli Clover
Chrome's latest update, which added support for iOS 7, also included a significant flaw that was discovered by design firm Parallax (via TechCrunch). When using the search or address bar in an Incognito window within the app, browsing history will be saved and shared with the standard Google.com browser.


Google’s Incognito mode is designed to keep searches for sensitive information private, but as detailed in the video, searches will be displayed when the standard Google.com browser is accessed. The flaw can be replicated with the following steps:

- Open an Incognito window
- Enter a search term in the address bar and hit enter
- Open a non-Incognito window
- Navigate to Google.com
- Tap the search box on the page to see Incognito searches

TechCrunch contacted Google and learned that there is no fix for the issue, as it is an "unfortunate but unavoidable loophole that comes with building a browser for iOS. The company cites its Incognito support note, which does address the issue.
On Chrome for iOS, due to platform limitation regular and incognito* tabs share HTML5 local storage, which is typically used by sites to store files on your device (client-side caching) or to provide offline functionality. This means the same sites can always access their data in this storage in both regular and incognito* tabs. Incognito* tabs will still keep browsing history and cookies separate from regular tabs, which are cleared once those tabs are closed.
Apple’s default Safari browser does not appear to have the same issue, accurately hiding searches made in Private mode.

Top Rated Comments

(View all)

Posted: 15 months ago
Hey everyone, Google here. We screwed something up in our browser. Apple's fault, not it!
Rating: 8 Votes
Posted: 15 months ago
I wouldn't be so quick to say "Safari is able to do it." Simply due to the fact Apple doesn't have to follow its own submission process, and their apps can have certain privileges that third-parties cannot.
Rating: 6 Votes
Posted: 15 months ago



TechCrunch contacted Google and learned that there is no fix for the issue, as it is an "unfortunate but unavoidable loophole that comes with building a browser for iOS. The company cites its Incognito support note (https://support.google.com/chrome/answer/95464?hl=en), which does address the issue. Apple's default Safari browser does not appear to have the same issue, accurately hiding searches made in Private mode.


Someone is dropping the ball.
Rating: 3 Votes
Posted: 15 months ago

I wouldn't be so quick to say "Safari is able to do it." Simply due to the fact Apple doesn't have to follow its own submission process, and their apps can have certain privileges that third-parties cannot.


Indeed, this would seem to be exactly the case, since Apple doesn't let third-party apps restrict HTML5 local storage, which is what Google and other sites use for this search history.

It's also been like this since at least iOS 6, so it's weird that it's suddenly getting all this coverage.
Rating: 3 Votes
Posted: 15 months ago

Hey everyone, Google here. We screwed something up in our browser. Apple's fault, not it!


Your not Google; I'm Google. Sorry we screwed up as our programming skills appear to be lacking with mobile apps. I would like to say it won't happen again but it probably will.

We can all play Google; and Google wouldn't just blame it all on Apple.
Rating: 2 Votes
Posted: 15 months ago
"TechCrunch contacted Google and learned that there is no fix for the issue, as it is an "unfortunate but unavoidable loophole that comes with building a browser for iOS. The company cites its Incognito support note, which does address the issue. Apple's default Safari browser does not appear to have the same issue, accurately hiding searches made in Private mode."

Translation: We think we're smart enough to use the "It's iOS, not us." Trojan Horse to continue to surreptitiously gather information on people who are naive enough to trust us.
Rating: 2 Votes
Posted: 15 months ago
Guess I don't see the big draw to not use iOS Safari. I think it works rather well . Guess it provides benefits to some, but I see no reason to stray from built in apps if you don't have to.
Rating: 2 Votes
Posted: 15 months ago
That's infuriating!

That's my personal information, intended ONLY for the eyes of Google, Google employees, Google advertisers, Google partners, and Google long-term data storage.

I could swear that other non-Apple browsers get this right, but I haven't used any for long.

It sounds trivial, if nothing else, to simply "flag" items in the history as being private, and simply NOT display them in a non-private tab. "No fix"?? OK, so you can't use separate storage (maybe) but you CAN still note the difference between private an non-private searches!

Or simply don't store the private ones at all, if that's the quickest workaround. I'm sure there are many ways, ideal or not.
Rating: 2 Votes
Posted: 15 months ago
Google is flat out full of bologna. This is their bug, irrefutably.

Sure, it's true that local storage is shared between incognito and normal modes, but it's also trivial to prefix all your storage keys with "incognito-" while reading/writing in incognito mode, and ensuring that normal mode never reads/writes storage keys prefixed with "incognito-".

Would your sensitive data still be on your system? Yeah, chrome would have to periodically clear all "incognito-" prefixed keys' values to resolve that. But at least these sensitive values would never be displayed via the browser. Only a data miner with access to your file system could get at them.

This kind of fix could be performed by a novice engineer. It is an embarrassing bug, not Apple's fault. Not unavoidable.
Rating: 2 Votes
Posted: 15 months ago

…the standard Google.com browser.


Sorry, but need to call you out on this poor wording. Google.com is a website, Chrome is a browser—there is no “Google.com browser”.
Rating: 1 Votes

[ Read All Comments ]