Can't turn off Sandboxed Chrome Web Browser accessing Google Chrome cookies

Hi janedoe,

Please provide the rest of the required info so that I can set up the scenario and test it:
How to report problems with Sandboxie

Additionally, please post a copy of your config file (Configure --> Edit configuration. Copy/paste the contents here).

Thanks!

Hi Barb, 

Thanks for replying, here are the details:

• Windows 10 Home V1903 (last updated 2019-08-29)
  Sandboxie 5.31.2
  Affected applications: Chrome Browser (might also affect other browsers but I only use Chrome)
  Antivirus: none

Steps to reproduce issue:

1. Turn off all direct access exclusions in Sandbox Settings>Applications>Web Browser>Google Chrome.

2. Open Sandboxie Chrome Browser, log out of Facebook or Amazon if you are logged in.

3. Close Sandboxie Chrome Browser.

4. Open a regular, non-sandboxed Chrome Browser and log into Facebook or Amazon.

5. Once logged into your account in the non-sandboxed browser, open a Sandboxie Chrome Browser and visit Facebook or Amazon (whichever you logged into).

6. You should find that you are logged into these sites in Sandboxie Chrome Browser even though direct access to Google Chrome cookies is turned off (step 1).

• This issue occurs in a new sandbox with default settings.
• There are no error messages or anything like that. If you weren't aware that Sandboxie was accessing cookies you wouldn't even know there is a security issue.

CONFIGURATION:

[GlobalSettings]

Template=AdobeDistiller
Template=WindowsRasMan
Template=WindowsLive
Template=AdobeAcrobatReader
Template=Evernote
Template=WacomTablet
Template=OfficeLicensing

[DefaultBox]

ConfigLevel=7
AutoRecover=y
BlockNetworkFiles=y
Template=qWave
Template=WindowsFontCache
Template=BlockPorts
Template=LingerPrograms
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
BorderColor=#00FFFF,ttl
Enabled=y
CopyLimitKb=1027483

[UserSettings_0C56020E]

SbieCtrl_UserName=ashle
SbieCtrl_BoxExpandedView=DefaultBox
SbieCtrl_NextUpdateCheck=1568242743
SbieCtrl_UpdateCheckNotify=n
SbieCtrl_ShowWelcome=n
SbieCtrl_WindowCoords=153,94,1237,632
SbieCtrl_ActiveView=40021
SbieCtrl_AutoApplySettings=n
SbieCtrl_HideWindowNotify=n

Hi Barb, 

Thanks for replying, here are the details:

• Windows 10 Home V1903 (last updated 2019-08-29)
  Sandboxie 5.31.2
  Affected applications: Chrome Browser (might also affect other browsers but I only use Chrome)
  Antivirus: none

Steps to reproduce issue:

1. Turn off all direct access exclusions in Sandbox Settings>Applications>Web Browser>Google Chrome.

2. Open Sandboxie Chrome Browser, log out of Facebook or Amazon if you are logged in.

3. Close Sandboxie Chrome Browser.

4. Open a regular, non-sandboxed Chrome Browser and log into Facebook or Amazon.

5. Once logged into your account in the non-sandboxed browser, open a Sandboxie Chrome Browser and visit Facebook or Amazon (whichever you logged into).

6. You should find that you are logged into these sites in Sandboxie Chrome Browser even though direct access to Google Chrome cookies is turned off (step 1).

• This issue occurs in a new sandbox with default settings.
• There are no error messages or anything like that. If you weren't aware that Sandboxie was accessing cookies you wouldn't even know there is a security issue.

CONFIGURATION:

[GlobalSettings]

Template=AdobeDistiller
Template=WindowsRasMan
Template=WindowsLive
Template=AdobeAcrobatReader
Template=Evernote
Template=WacomTablet
Template=OfficeLicensing

[DefaultBox]

ConfigLevel=7
AutoRecover=y
BlockNetworkFiles=y
Template=qWave
Template=WindowsFontCache
Template=BlockPorts
Template=LingerPrograms
Template=Firefox_Phishing_DirectAccess
Template=AutoRecoverIgnore
RecoverFolder=%{374DE290-123F-4565-9164-39C4925E467B}%
RecoverFolder=%Personal%
RecoverFolder=%Favorites%
RecoverFolder=%Desktop%
BorderColor=#00FFFF,ttl
Enabled=y
CopyLimitKb=1027483

[UserSettings_0C56020E]

SbieCtrl_UserName=ashle
SbieCtrl_BoxExpandedView=DefaultBox
SbieCtrl_NextUpdateCheck=1568242743
SbieCtrl_UpdateCheckNotify=n
SbieCtrl_ShowWelcome=n
SbieCtrl_WindowCoords=153,94,1237,632
SbieCtrl_ActiveView=40021
SbieCtrl_AutoApplySettings=n
SbieCtrl_HideWindowNotify=n

Hi janedoe,

This is not a security issue, the sandboxed application is not modifying your host (from what you are describing). Sandboxie has read access to your host by default (otherwise it wouldn't' work). 
The web browser options in Sandboxie allow the Sandboxed browser to make changes to the host browser, not the other way around. Here's more info:
https://www.sandboxie.com/ApplicationsSettings#web

If you don't want Sandboxie to see your Chrome profile/cookies, you can try using the following options:
https://www.sandboxie.com/ResourceAccessSettings#file 

Use Write Only or Blocked access to tell Sandboxie which folders from your host it shouldn't read/access.  Point them to your host's Chrome cookies/sessions/history/whatever you need to block. Then re-test.
Or, as another suggestion, use incognito mode. And also, make sure you are not logged in to your Google Account in the Sandboxed browser, as that can also sync it with Chrome. 

Regards,