Chromium First Load Complete Security Bypass

[CyberpunkIsBae]

Prerequisites

• I verified that this is not a filter issue
  • Filter issues MUST be reported at filter issue tracker
• This is not a support issue or a question
  • Support issues and questions are handled at /r/uBlockOrigin
• I performed a cursory search of the issue tracker to avoid opening a duplicate issue
  • Your issue may already be reported.
• I tried to reproduce the issue when...
  • uBlock Origin is the only extension
  • uBlock Origin with default lists/settings
  • using a new, unmodified browser profile
• I am running the latest version of uBlock Origin
• I checked the documentation to understand that the issue I report is not a normal behavior

Description

On Linux uBlock Origin fails to protect the Chromium browser whatsoever from malicious scripts or other page threats on first load while opening a page (in this case, my homepage). You probably have a race condition, but this is the most severe kind of bug a security plugin can have (that it simply fails to work in a specific case). Please fix this. I can imagine a scenario where someone had a bad tab open (blocked) and then the power goes out and the session restores and boom uBlock was trusted and failed to protect.

A specific URL where the issue occurs

Why did you make this section mandatory if it happens on any page? Pedantic much? I'm doing you a favor - but ok, use www.yahoo.com or whatever

Steps to Reproduce

1. Shut down Chromium
2. Launch Chromium with a page that clearly displays differently with javascript off, in this case, I had it as my homepage (yahoo.com)
3. Observe that javascript is not blocked
4. Refresh the page
5. Ruh roh raggy

Expected behavior:

I expect you to test your code.

Actual behavior:

You didn't.

Your environment

• uBlock Origin version: Newest
• Browser Name and version: Chromium newest
• Operating System and version: Linux

[uBlock-user]

Duplicate of gorhill/uBlock#1327

https://github.com/gorhill/uBlock/wiki/Advanced-settings#suspendtabsuntilready-experimental