[znpy]

> Chrome introduced a new API, window.showDirectoryPicker() that allows the user to grant access to a directory on their computer and allow a website to read/write everything inside.

I mean, what could go wrong?

It's not like an user is tricked into uploading a file from a folder (let's say, the main "Documents" folder) and some malicious website steals all the files over there.

[bigrocketapps]

If you tried this out in Linux, for example, the system would block you from selecting folders that contain files that are flagged as dangerous or "system files". I'm assuming this was implemented across all OSes.

[blharr]

That does not sound at all reassuring, that the only safeguard is the system blocking access and that the API has no safeguard.

Its also easily possible to have sensitive files misplaced, especially for a general non-technical user that would be the one falling for a browser hijacking attack

[bigrocketapps]

I have not checked the source code to tell you if the system is the one blocking access or the browser-level API itself. I'm guessing it's the browser. The only reason I mentioned Linux is that's where I tested it and I'm sure there are differences across OSes.

My biggest concern here is the write permission.

[znpy]

i give zero F about whatever is in my /usr, /var/lib and /opt folders.

what are websites gonna steal, debian binaries and libraries?

all my important stuff are in my home directory, which is owned (read+write) by me, the same user running the browser.