Hacker News Reader

Comment by Jaruzel | Hacker News Reader

> Are you sure your network is not compromised?

It's definitely not. Also used 3 different browsers - each one showed the same dialog but with the name and version of that browser. It doesn't happen on my mobile over WiFi (rules out network injection).

This is what I'm seeing: https://imgur.com/a/o9PNmaU

It's being inserted via a .js file on static.remove.bg:

https://static.remove.bg/remove-bg-web/38c6be57b031c26a2186b...

(search for 'out of date' )

So either the site owner is complicit, or they've been hacked.

Edit: Fired up a VM of Windows 7 - Same message - so unless my routers been hacked to inject that script somehow, i'm 99% certain it's not me.

View on HN

Looking at the code, it is using a script from Browser Update[1] to determine whether to show that message.

Here's the line from the js you linked to that checks the browser version:

    window.checkBrowserVersion = function() { i()({ required: { i: 12, e: -4, f: -3, o: -3, s: -1, c: -3 }, insecure: !0, unsupported: !0, reminder: 0, reminderClosed: 168, style: "corner", api: 2019.06, test: !1, onshow: function() { window.track && window.track("BrowserUpdate", "outdated_version_dialog", "Browser version outdated dialog") } }) }, $((function() { window.checkBrowserVersion() }));

The c: -3 is the crucial bit that should cause it to trigger if your version is at least 3 versions out of date.

Yours isn't though. Can you access http://browser-update.org ? If not, then there might be something with your DNS settings. Have you tried tethering through your phone? Have you changed your user agent?

1. http://browser-update.org/#install

Just checked, and my Chrome is on version 84. Version 80 is out of date.

You need to update Chrome.

To be frank, I don't need to do anything. I'll update Chrome when I'm ready, thanks.

What I object to, is a dodgy popup appearing on an unrelated website.

That's interesting. Number of versions is probably a weak signal for this --- but how many browser versions should the dev a small site be looking for? Things DO break...

You don't need to call an ambulance when you break your leg, but your browser has at least five high vulnerabilities (and one critical vulnerability).

Are you sure it's malware? Looking at the code it seems to redirect to "browser-update.org" and is genuinely redirecting only older browsers based on unsupported features.

Reply on news.ycombinator.com