Hacker News Reader

Comment by Jaruzel | Hacker News Reader

BEWARE. remove.bg seems to have a malware/fake Chrome update popup.

It's a hint for outdated browsers, it's not an ad and there's nothing malicious behind it (unless there's an issue in your local network or machine perhaps?).

http://browser-update.org/ https://www.npmjs.com/package/browser-update

It's a fine line though to not get into the way with things like this, and we could certainly improve it's appearance a bit - sorry for that.

I think trying to emulate a built in browser notification is the wrong way to go. I wouldn't have got as concerned if the popup looked more like a web page overlay, with wording along the lines of:

"Hi we're from Browser-update.org (clickable), and this site has asked us to check your browser version. Your browser version is out of date, and should be upgraded. Please go to your [settings] menu to update, or visit [us] for more information."

Of course, feel free to totally ignore my suggestions - it's a free world. ;)

Fresh Chromium installation, no adblocking or other content blocking plugins. Zero advertisements and popups on that site. I keep reading these kind of comments on HN and everytime it seems to be only that one person reporting the problem that sees that behavior. Are you sure your network is not compromised?

Perhaps the GP is receiving malware through a targeted or non-targeted advertising campaign.

> Are you sure your network is not compromised?

It's definitely not. Also used 3 different browsers - each one showed the same dialog but with the name and version of that browser. It doesn't happen on my mobile over WiFi (rules out network injection).

This is what I'm seeing: https://imgur.com/a/o9PNmaU

It's being inserted via a .js file on static.remove.bg:

https://static.remove.bg/remove-bg-web/38c6be57b031c26a2186b...

(search for 'out of date' )

So either the site owner is complicit, or they've been hacked.

Edit: Fired up a VM of Windows 7 - Same message - so unless my routers been hacked to inject that script somehow, i'm 99% certain it's not me.

Are you sure it's malware? Looking at the code it seems to redirect to "browser-update.org" and is genuinely redirecting only older browsers based on unsupported features.

Looking at the code, it is using a script from Browser Update[1] to determine whether to show that message.

Here's the line from the js you linked to that checks the browser version:

    window.checkBrowserVersion = function() { i()({ required: { i: 12, e: -4, f: -3, o: -3, s: -1, c: -3 }, insecure: !0, unsupported: !0, reminder: 0, reminderClosed: 168, style: "corner", api: 2019.06, test: !1, onshow: function() { window.track && window.track("BrowserUpdate", "outdated_version_dialog", "Browser version outdated dialog") } }) }, $((function() { window.checkBrowserVersion() }));

The c: -3 is the crucial bit that should cause it to trigger if your version is at least 3 versions out of date.

Yours isn't though. Can you access http://browser-update.org ? If not, then there might be something with your DNS settings. Have you tried tethering through your phone? Have you changed your user agent?

1. http://browser-update.org/#install

Just checked, and my Chrome is on version 84. Version 80 is out of date.

You need to update Chrome.

To be frank, I don't need to do anything. I'll update Chrome when I'm ready, thanks.

What I object to, is a dodgy popup appearing on an unrelated website.

That's interesting. Number of versions is probably a weak signal for this --- but how many browser versions should the dev a small site be looking for? Things DO break...

You don't need to call an ambulance when you break your leg, but your browser has at least five high vulnerabilities (and one critical vulnerability).

Reply on news.ycombinator.com