Chrome has a built-in extension that uses public Chrome APIs that are easily available to other Chrome extensions. The issue described is that this extension shares this information to Google's own domains when they're communicating with the extension, while other websites can't do this.
There's no "special hidden API".
"hidden" in the sense that when I go to chrome://extensions it is not listed.
And as you already mentioned, it's a Chrome API.
chrome.runtime.sendMessage(
'nkeimhogjdpnpccoofpliimaahmaaome', {
method: 'cpu.getInfo'
}, response => {
console.log('CPU Info:\n', JSON.stringify(response, null, 2));
}
);By controlling the engine, they have de facto control over the standards.
By keeping Chromium open, they incentivise forks. Most people who don't want to use Chrome because it's Google's or for some other reason will use one of the forks or Chromium-based browsers.
By keeping this illusion of choice, Google extends its control.
It would be silly if that PWA-implemented browser code would need permission to access the system information, since it is part of the browser's functionality itself.
Another use case for a private API (that has long existed) is integration of the Chrome browser with Google-specific websites that provide core functionality, like the Chrome Web store, to allow for installation/removal of extensions from a web page.
Down-thread I see that this is being used for Google Meet functionality, for which I agree it should ask for the user's permission.
Yes. We need much more of this on the desktop.
To prompt the user for every type of IPC would make the software unusable. No desktop software does that on any platform.
It would be like a car asking the user for permission for the steering wheel to access the front axle.
If there exists a mundane and reasonable explanation for this, that doesn’t matter if there also exists a potential to exploit it in a way that harms consumers’ interests.