Chrome Tracks Every Key Typed into the Omnibox

> Friendly Reminder: Browser makers may track every key you type in the URL bar


Technologies like Google Chrome’s Omnibox makes searching easier. However, these quick search suggestions come at a price. This post is a friendly reminder that you may want to consider turning off predictive search to protect your privacy.

How the Omnibox Works

Predictive search isn’t magic. Chrome doesn’t come shipped with a built-in collection of popular searches. No, the only way to get suggestions for what you are searching is to ask Google. This happens by sending a request to Google for search suggestions for every key typed in the omnibox - by default.

What does this look like? After installing Burp’s CA certificate and starting chrome.exe with the --allow-ssl-mitm-proxies option, we can see the following requests pop up as we search:

GET /complete/search?client=chrome-omni&gs_ri=chrome-ext&xssi=t&q=o
GET /complete/search?client=chrome-omni&gs_ri=chrome-ext&xssi=t&q=om
GET /complete/search?client=chrome-omni&gs_ri=chrome-ext&xssi=t&q=omg
GET /complete/search?client=chrome-omni&gs_ri=chrome-ext&xssi=t&q=omgw
GET /complete/search?client=chrome-omni&gs_ri=chrome-ext&xssi=t&q=omgwt
GET /complete/search?client=chrome-omni&gs_ri=chrome-ext&xssi=t&q=omgwtf
GET /complete/search?client=chrome-omni&gs_ri=chrome-ext&xssi=t&q=omgwtfb
GET /complete/search?client=chrome-omni&gs_ri=chrome-ext&xssi=t&q=omgwtfbb
GET /complete/search?client=chrome-omni&gs_ri=chrome-ext&xssi=t&q=omgwtfbbq

But I’m searching these things anyway!

Sure, this might be fine for searches, but what else could be sent via this method? Hostnames, web addresses, and IP addresses are all sent to Google before you press enter. This means that Google knows if you visit a website, even if you don’t visit the site from search results.

Disabling Omnibox

Since this setting is enabled by default, here’s how to disable it:

1 Navigate to chrome://settings

2 Click “Show Advanced Settings”

3 Uncheck “Use a prediction service to help complete searches…”

Chrome Isn’t the Only One

It’s important to note that Chrome isn’t the only browser that has this capability. Internet Explorer has the same feature from Bing. The only difference is that this isn’t default behavior, and has to be explicitly enabled.

Putting Things in Perspective

This isn’t new information - more of a friendly reminder. It’s important to put these privacy “risks” in perspective and determine what is more important to you - keeping your browsing history and IP/hostname scheme private, or getting solid search suggestions.

As always, let me know if you have any questions/comments below.

-Jordan (@jw_sec)

Jordan Wright

Security Researcher, Programmer, Time's 2006 Person of the Year

San Antonio, Texas