diff --git a/BROWSER.md b/BROWSER.md index 1a18b2997..f2d8cfb4c 100644 --- a/BROWSER.md +++ b/BROWSER.md @@ -562,7 +562,7 @@ from `snapshot`, or `@c` refs from `snapshot -C`. Full table: |---------|-------------| | `cookie =` | Set cookie on current page domain | | `cookie-import ` | Import cookies from JSON file | -| `cookie-import-browser [browser] [--domain d] [--profile p] [--all] [--clear-storage] [--verify-auth]` | Copy selected browser cookies; picker by default, explicit scoped or all-domain import, optional storage reset and sign-in assertion. The imported session rides on the bundled Chromium's root store ([TLS trust](#tls-trust-the-bundled-chromiums-root-store)) | +| `cookie-import-browser [browser] [--domain d] [--profile p] [--all] [--clear-storage] [--verify-auth]` | Copy selected browser cookies; picker by default, explicit scoped or all-domain import, optional storage reset and sign-in assertion. The imported session rides on the fallback browser's root store ([TLS trust](#tls-trust-the-bundled-chromiums-root-store)) | | `header :` | Set custom request header (sensitive values auto-redacted) | | `useragent ` | Set user agent (triggers context recreation, invalidates refs) | @@ -1320,8 +1320,8 @@ uses your own browser's trust store and updates. by CRLSet on 2026-10-17, the day the compromise was reported, and scheduled the removal of their root, emSign ECC Root CA - G3, from the Chrome Root Store for 2026-10-27. As of 2026-10-24, gstack's pinned Playwright 1.62.1 (Chromium 151), -the latest release 1.64.1 (Chromium 156) and the 1.65 alphas (Chromium 157) -still trust them, so +the latest release 1.64.1 (Chromium 156) and the 1.65.0 alpha of 2026-10-24 +(Chromium 157) still trust them, so `$B goto https://dv-g3b-emudhra.we-have-a-problem.com/` loads a page saying "That's bad!" instead of failing with `ERR_CERT_AUTHORITY_INVALID` (headed mode fails it with `ERR_CERT_REVOKED` once its CRLSet arrives). gstack will move to diff --git a/CHANGELOG.md b/CHANGELOG.md index 7401305ac..21d6bf347 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,7 +2,7 @@ ## [Unreleased] -**BROWSER.md now says that gstack's own browser still trusts the compromised eMudhra intermediates, and how to check (#3338).** Chrome blocked the eight eMudhra intermediate CAs with a CRLSet push on 2026-10-17, the day their key compromise was reported, and scheduled the removal of their root, emSign ECC Root CA - G3, from the Chrome Root Store for 2026-10-27. gstack's fallback browser gets neither in time: its default headless browser never receives CRLSet updates, headed mode and `handoff` receive them only about a minute after each launch, and the root store compiled into the bundled Chromium still trusts the root. On 2026-10-24, `$B goto https://dv-g3b-emudhra.we-have-a-problem.com/` returned 200 and "That's bad!" on gstack's pinned Playwright 1.62.1 (Chromium 151.0.7922.34). The same check against Playwright 1.64.1 (Chromium 156.0.8078.4) and the 1.65.0 alpha of 2026-10-24 (Chromium 157.0.8103.15) also loaded the page. Chrome for Testing builds from 158.0.8115.0 fail it with `ERR_CERT_AUTHORITY_INVALID`, so a Playwright bump has to wait for a release that bundles one of those builds. +**BROWSER.md now says that gstack's own browser still trusts the compromised eMudhra intermediates, and how to check (#3338).** Chrome blocked the eight eMudhra intermediate CAs with a CRLSet push on 2026-10-17, the day their key compromise was reported, and scheduled the removal of their root, emSign ECC Root CA - G3, from the Chrome Root Store for 2026-10-27. gstack's fallback browser gets neither in time: its default headless browser never receives CRLSet updates, headed mode and `handoff` received them only about a minute after each launch in testing on Linux (#3338, from macOS, reports that gstack's profile never gets one), and the root store compiled into the bundled Chromium still trusts the root. On 2026-10-24, `$B goto https://dv-g3b-emudhra.we-have-a-problem.com/` returned 200 and "That's bad!" on gstack's pinned Playwright 1.62.1 (Chromium 151.0.7922.34). The same check against Playwright 1.64.1 (Chromium 156.0.8078.4) and the 1.65.0 alpha of 2026-10-24 (Chromium 157.0.8103.15) also loaded the page. Chrome for Testing builds from 158.0.8115.0 fail it with `ERR_CERT_AUTHORITY_INVALID`, so a Playwright bump has to wait for a release that bundles one of those builds. ### Changed - **`BROWSER.md`**: a new "TLS trust: the bundled Chromium's root store" section, at the end of the security stack, says the fallback engine checks certificates against that compiled root store, that the headless browser never gets CRLSet updates while headed mode and `handoff` got them about a minute after launch in testing on Linux, and that the bundled build does not enforce Certificate Transparency. It names the commands that put real sessions and credentials into the browser (among them `cookie-import-browser`, `cookie-import`, `cookie`, `header`, `state load`, `storage set`, `fill`/`type`, `upload`, `handoff`, and a paired agent using `fill`/`type`), lists where imported sessions persist, says how `BROWSE_EXTENSIONS_DIR` and `GSTACK_CHROMIUM_PATH` change the picture (`handoff` always uses the bundled build, and a current Chrome only helps if it drops the root), and gives the `$B goto` check: after `$B stop`, in headless mode with `BROWSE_PROXY_URL=direct`, and once a known-good HTTPS site loads in the same session, only `ERR_CERT_AUTHORITY_INVALID` on the test host means a build is fixed. The table of contents, the fallback-engine introduction and the `cookie-import-browser` and `handoff` command rows link to it. Aside is unaffected, because it is your own browser with its own updates.