Google says it will block the use of private Google APIs by third-party Chromium web browsers after discovering that they incorporated and used them even though they were intended to be used only in Chrome.
This is because many of the Google APIs included in the Chromium code are specific to Google Chrome and are not intended to be integrated and used by users of derived Chromium products.
“During a recent audit, we discovered that some third-party browsers based on Chromium were able to integrate Google features, such as Chrome sync and Click to Call, that are intended for use only on Google,” explained director Jochen Eisinger.
“This meant that a small portion of users could sign in to their Google account and store their personal Chrome browsing data, such as bookmarks, not only with Google Chrome, but also with some third-party browsers based on Chromium.”
Eisinger did not share the names of the browsers that incorporated the Chrome Sync feature without authorization, but he did reveal that the company will restrict third-party Chromium browsers' access to Chrome's private APIs starting March 15, 2021.
By removing access to Chrome sync for other Chromium web browsers, it removes ability to integrate the Chrome Sync API to sync their users' data across all devices where users are signed in to their Google account.
When Chrome Sync is enabled, synced information includes passwords, history, open tabs, settings, preferences, and, in some cases, even payment information stored in Google Pay.
However, Google says that users who have accessed private Google features, such as Chrome Sync, while using third-party browsers will still have access to that synced data locally or in their Google account, depending on their sync settings.
They will also be able to manage their data by going to the “My Google Activity” page, as well as download it from the “Google Takeout” page and/or delete it by going here.
Information source: bleepingcomputer.com
