Researcher devises simple exploit to prevent Password Alert Chrome extension from warning about phishing, then quickly creates another after Google patches
Dan Goodin / Ars Technica :
Context & Ripple Effects
Google's Password Alert extension had been live for only days when a researcher demonstrated that a simple exploit stops it from warning users who type their Google password on phishing pages. The cat-and-mouse was immediate: Google shipped a patch, and the researcher produced a second bypass shortly after.
The episode matters because Password Alert was pitched as a client-side tripwire for credential theft — and its core defense turned out to be defeatable with basic techniques. Later coverage reinforced the pattern: researchers found mobile browsers failed to show phishing warnings at all between mid-2017 and late 2018 due to a Safe Browsing API issue, and by 2019 Google's own data from Password Checkup showed 1.5% of site logins used compromised credentials.
First-order effects
- Users running Password Alert get a warning they cannot rely on — an attacker stripping it leaves no signal that the page is phishing, so the protection degrades to ordinary user judgment.
- Google is pulled into an immediate patch cycle on a brand-new product, fixing one bypass only to face another within days.
Second-order effects
- Attackers gain a cheap template: any client-side warning rendered inside the browser can be suppressed the same way, pressuring Google and extension developers to harden rendering paths or accept silent failure.
- The credibility hit pushes defenders toward defenses that don't depend on what the victim's browser displays — server-side credential checking of the kind Password Checkup later provided.
Third-order effects
- If bypass-and-patch cycles are the norm, anti-phishing tooling migrates structurally away from client-side warnings toward server-side detection and breach-corpus matching — the direction Google's own follow-on products took.
- Browsers and password managers face a standing burden to treat their own UI as attack surface; the 2017 finding that extensions like LastPass could be tricked via hidden text boxes into leaking private information extended that lesson beyond phishing banners.
The trend: Browser-based phishing defenses are converging from client-side warning banners toward server-side credential verification, because anything rendered in the page can be attacked.