#883746 chromium: secretly stores referer and url for downloaded files

Package:
chromium
Source:
chromium
Description:
web browser
Submitter:
Adam Borowski
Date:
2026-07-06 17:45:16 UTC
Severity:
important
Tags:
#883746#5
Date:
2017-12-07 05:40:23 UTC
From:
To:
Package: chromium
Version: 62.0.3202.89-1
Severity: important

Hi!
If you download and save a file with Chromium (even in incognito mode), it
saves potentially sensitive metadata in a way that's completely unknown to
almost all users, even highly technical ones:

user.xdg.referrer.url: https://angband.pl/tmp/
user.xdg.origin.url: https://angband.pl/tmp/20130210_001.jpg

This photo is embarassing, but not overwhelmingly so.  It also, on its own,
appears to include no way to tie to me in particular.  There's EXIF but,
coming from a sane camera, it has no GPS data or whatever.  Yet, once the
URL is smuggled, the link to me is obvious, and it's easy to distort the
image's story into something that could get someone fired or otherwise
publicly shamed (based on typical kitten behaviour).

And it can get worse: imagine (werewolf protection) a kiddie porn image,
or a secret government file ("Hillary and Donald, sitting in a tree,
K.I.S.S.I.N.G.jpg").

In this case, referer is uninteresting, but it can be as bad or worse than
the URL itself.

This is a concern when the file is copied to any xattr-preserving media,
such as an USB stick or a CIFS mount -- or, if your computer itself is
imaged/accessed.


Meow!
#883746#10
Date:
2017-12-09 02:00:19 UTC
From:
To:
For comparison, Chromium on Windows doesn't have this privacy hole:

ꜰɪʟᴇ: user.Zone.Identifier: [ZoneTransfer]
ZoneId=3

(Ie, it saves merely whether the file came from this computer, local
network, or the Interwebs at large.)


I assume Chromium on Android does, which is a lot worse than regular
computers, as phones get seized/imaged/stolen drastically more often.


Meow!
#883746#17
Date:
2018-09-17 13:49:23 UTC
From:
To:
This is tangentially related but I found that GNU wget (1.19.5 on my
system) also stores this information, and there is no way to turn it
off; it's not mentioned in the documentation. I wonder what the FSF's
take is on this.
#883746#22
Date:
2019-03-15 03:30:41 UTC
From:
To:
I've been asked where wget stores the URL. Same place as Chromium, in the extended attributes. Here is my blog entry recounting my small investigation:

https://green-possum-today.blogspot.com/2018/09/chromechromium-is-storing-url-and.html
#883746#27
Date:
2019-03-17 16:38:47 UTC
From:
To:
The patch for wget has been written by a Google employee who works on
Chrome.  And, it has just (2018-12-26) been both disabled by default and
neutered wrt what it saves even when manually enabled:

# * Changes in Wget 1.20.1
#
# ** --xattr is no longer default since it introduces privacy issues.
#
# ** --xattr saves the Referer as scheme/host/port, user/pw/path/query/fragment
#    are no longer saved to prevent privacy issues.
#
# ** --xattr saves the Original URL without user/password to prevent
#    privacy issues.

I'd say the same should be done in Debian-shipped Chromium.


Meow!
#883746#32
Date:
2020-10-26 13:18:18 UTC
From:
To:
Hi, this is Miss Sibel US Army and Medical practitioner from United States. Please I will need you to contact me through my email for an important discussion. Thanks and remain blessed  
#883746#35
Date:
2023-05-03 23:17:50 UTC
From:
To:
On Sun, 17 Mar 2019 17:38:47 +0100 Adam Borowski <kilobyte@angband.pl>
wrote:
 > On Fri, Mar 15, 2019 at 03:30:41AM +0000, Ken Yap wrote:
 > > I've been asked where wget stores the URL.  Same place as
Chromium, in the
 > > extended attributes.  Here is my blog entry recounting my small
 > > investigation:
 > >
 > >
https://green-possum-today.blogspot.com/2018/09/chromechromium-is-storing-url-and.html
 >
 > The patch for wget has been written by a Google employee who works on
 > Chrome.  And, it has just (2018-12-26) been both disabled by default
and
 > neutered wrt what it saves even when manually enabled:
 >
 > # * Changes in Wget 1.20.1
 > #
 > # ** --xattr is no longer default since it introduces privacy issues.
 > #
 > # ** --xattr saves the Referer as scheme/host/port,
user/pw/path/query/fragment
 > #    are no longer saved to prevent privacy issues.
 > #
 > # ** --xattr saves the Original URL without user/password to prevent
 > #    privacy issues.
 >
 > I'd say the same should be done in Debian-shipped Chromium.
 >

Did upstream change this behavior? i'm just looking at this bug now,
and I'm unable to reproduce it. If I use wget --xattr, I can see it:

dilinger@5410:/tmp$ wget -q --xattr
https://github.com/ssokolow/rar-test-files/raw/master/build/testfile.rar3.av.rar
dilinger@5410:/tmp$ getfattr -d testfile.rar3.av.rar
# file: testfile.rar3.av.rar
user.xdg.origin.url="https://raw.githubusercontent.com/ssokolow/rar-test-files/master/build/testfile.rar3.av.rar"
user.xdg.referrer.url="https://github.com"


But if I download the same file with chromium (113.0.5672.63-1):

dilinger@5410:/tmp$ rm testfile.rar3.av.rar
dilinger@5410:/tmp$ getfattr -d testfile.rar3.av.rar
dilinger@5410:/tmp$