Google to Fix Chrome Loophole That Exposed Incognito Status to Websites

Google is updating the Incognito Mode of its Chrome browser to protect users from being tracked by third-party sites. The search giant in a detailed blog post revealed that it is fixing a loophole that has allowed sites to detect users who are browsing in the Incognito Mode. The loophole, which exists in Chrome's FileSystem API, will be fixed through the release of Chrome 76, the company said in the blog post. The loophole has been widely known in the Web development community.

The Incognito Mode is claimed to restrain Google Chrome from saving your browsing history and capturing cookies, site data, and information you entered in forms. However, the feature presently still allows sites to know if users are browsing through Incognito mode using the loophole within the FileSystem API of the browser.

"Chrome's FileSystem API is disabled in Incognito Mode to avoid leaving traces of activity on someone's device. Sites can check for the availability of the FileSystem API and, if they receive an error message, determine that a private session is occurring and give the user a different experience," explains Google's Partner Development Manager of News and Web Partnerships Barb Palser wrote in the blog post.

The Google engineers are changing the existing behaviour of the FileSystem API. The change will take place through the Chrome 76 release that is scheduled for July 30.

The latest change will impact sites that require visitors to log in or switch to regular browsing mode to deter metered paywall circumvention.

"Sites that wish to deter meter circumvention have options such as reducing the number of free articles someone can view before logging in, requiring free registration to view any content, or hardening their paywalls," notes Palser in the post. "Other sites offer more generous meters as a way to develop affinity among potential subscribers, recognising some people will always look for workarounds."

Google suggests publishers of paywall sites to monitor the effect of the FileSystem API update to implement required changes in their meter strategy.

The latest move by Google comes at an interesting juncture as just days ago a joint study from Microsoft Research, Carnegie Mellon University, and the University of Pennsylvania claimed that trackers from Google, Facebook, Oracle, and more were found on porn websites and were tracking everything that you do, no matter you were browsing in Incognito mode.

However, the new change will just block websites from knowing whether you are browsing in Incognito or not, and it doesn't impact the tracking being done on porn and other websites.