4 ms·

For those that are interested in the security around file system access please go here: https://developers.google.com/web/updates/2019/08/native-file-system#se

For those that are interested in the security around file system access please go here: https://developers.google.com/web/updates/2019/08/native-file-system#security-considerations https://developers.google.com/web/updates/2019/08/native-fil... If you look at the various restrictions, you will see that the user is in control of most of the operations. It restricts access to system folders. I do think that many lay people may still fall prey to attack vector sites that may save an evil EXE or something, hoping they will later click it. However, I suspect once we see this feature in action, hopefully it will disallow creating executable files.

zaphirplane 7y ago
I read the link you referenced. Am not clear on how seeming it action will mitigate the vector. Saving msi inf sys com files tick, save in locations people have open in explorer/finder tick. The mitigations appear around overriding Files in user and system directories and revoking access.
tinus_hn 7y ago
It’s not really possible to know which are executable files. The solution is to add the attribute that says the file was downloaded so it doesn’t run automatically.