AVG SECURE BROWSER PRO INSTALL
AVG SECURE BROWSER PRO UPDATE
AVG SECURE BROWSER PRO UPGRADE
AVG SECURE BROWSER PRO SOFTWARE

's response made it clear that there was more at stake.

The issue with the fix was that AVG only verified if avg.com was included in the origin which attackers could exploit by using subdomains that included the string, e.g. The company tried to limit exposure by only accepting requests if the origin matches avg.com. For example, can read email from, or, or whatever else.īascially, AVG is putting Chrome users at risk through its extension which supposedly should make web browsing safer for Chrome users.ĪVG responded with a fix several days later but it was rejected as it did not resolve the issue completely. There are multiple obvious attacks possible, for example, here is a trivial universal xss in the 'navigate' API that can allow any website to execute script in the context of any other domain.

AVG SECURE BROWSER PRO SOFTWARE

Nevertheless, my concern is that your security software is disabling web security for 9 million Chrome users, apparently so that you can hijack search settings and the new tab page. The extension is so badly broken that I'm not sure whether I should be reporting it to you as a vulnerability, or asking the extension abuse team to investigate if it's a PuP.

In a letter to AVG he wrote:Īpologies for my harsh tone, but I'm really not thrilled about this trash being installed for Chrome users.

AVG SECURE BROWSER PRO UPDATE

If you add to this that the company announced recently in a privacy policy update that it will collect and sell - non identifiable - user data to third-parties, you end up with a scary product on its own.Ī Google employee filed a bug report on December 15 stating that AVG Web TuneUp was disabling web security for nine million Chrome users. AVG earns when users make searches and click on ads on the custom search engine they have created. The main reason why these changes are made is money, not user security. If you check the Chrome settings after installation and activation of AVG Web TuneUp, you will notice that you cannot modify home page, start parameters or search providers anymore. If that is not bad enough, it is quite difficult to modify changed settings without disabling the extension. Quite a few issues arise from installing the extension, for instance that it changes the startup setting to 'open a specific page' ignoring the users choice (for instance to continue the last session). The extension that gets installed requests eight permissions including the permission to 'read and change all data on all websites', 'mange downloads', 'communicate with cooperating native applications', 'managing apps, extensions and themes', and changing home page, search settings and start page to a custom AVG search page.Ĭhrome notices the changes and will prompt users offering to restore settings to their previous values if the changes made by the extension were not intended.

The extension has more than 8 million users according to the Chrome Web Store (according to Google's own statistics nearly nine million).ĭoing so changes the home page, new tab page and default search provider in the Chrome and Firefox web browser if installed on the system. A click on ok in the interface installs AVG Web TuneUp in compatible browsers with minimal user interaction.

AVG SECURE BROWSER PRO INSTALL

Security companies started to add other revenue streams to their free offerings, and one of the most prominent one in recent time involved the creation of browser extensions and the manipulation of the browser's default search engine, home page and new tab page that go along with it.Ĭustomers who install AVG software on their PC get a prompt in the end to safeguard their browsers. The free version works fine on its own but is being used to advertise the paid version that is offering advanced features such as anti-spam or an enhanced firewall on top of that.

AVG SECURE BROWSER PRO UPGRADE

One part of the equation are getting customers to upgrade to paid versions of AVG and for a while, that was the only way things worked for companies like AVG.

AVG, like many other security companies offering free products, is using different monetization strategies to earn revenue from its free offerings.

Avg secure browser pro