Google Chrome Set To Follow Firefox In Blocking Out-of-date Plug-ins


It’s good news to see that Google is taking security issues seriously when it comes to its Chrome browser. This has been shown before when Google was Willing To Pay Bounty For Chrome Browser Bugs. And well honestly, we haven’t had a lot of news of exploits in Chrome.

Perhaps it’s because the user-base just isn’t that big yet? But to note, Chrome was the only browser in the recent Pwn2Own contest that did not get exploited.

Anyway the story is in this case, Chrome is taking a leaf from the book of Firefox and is planning to add the ability to block out-of-date plug-ins in the browser.

Google will soon prevent insecure versions of plug-ins from running on top of its Chrome browser to make sure they don’t contain security bugs that can be exploited by malicious websites.

In a blog post, members of Google’s security team said the feature, to be delivered “medium-term,” will prevent Chrome from running “certain out-of-date plug-ins.” It will also help users find updates.

The announcement comes a few months after anti-virus maker F-Secure said Adobe’s Reader application replaced Microsoft Word as the program that’s most often exploited in targeted malware campaigns, like the one that Google disclosed in January that exposed sensitive intellectual property. F-Secure said the increase is “primarily because there has been more vulnerabilities in Adobe Acrobat/Reader than in the Microsoft Office applications.” Other plug-ins such as Adobe’s Flash Player and Oracle’s Java Virtual Machine are also routinely attacked.

Firefox demonstrated the use of this function last October when Firefox Blocked the Microsoft .NET Framework Assistant Add-on.

It is important as there are so many Flash vulnerabilities, problems with PDF plug-ins and so on that the ability to disable/block plug-ins is indeed useful.

Plus there are so many user/3rd party contributed add-ons and plug-ins the browser developers do need a way to control them if they wish to retain a good level of browser security.

The ability to run scores of browser plug-ins makes it hard for users to keep their systems fully patched. Mozilla recently addressed this problem by notifying users who run out-of-date add-ons on top of Firefox. Google seems to be going one step further by blocking them altogether.

“Since many plug-ins are ubiquitous, they pose the most significant risk to our user base,” the Google employees wrote.

The auto-blocking will join several other security features being baked into Chrome. Chief among them is a home-grown PDF reader integrated into Chrome that sports its own security sandbox. This is now available in a developer build. The stable Chrome includes a built-in Flash plug-in that Google will automatically update via the browser’s existing update mechanism, which does not ask for the user’s approval.

Chrome has long boasted one of the most advanced sandbox designs, which thwarts attacks by running individual windows and plug-ins in a separate process with limited access to the operating system kernel. Chrome was the only browser at the recent Pwn2Own hacker contest that wasn’t exploited.

The feature isn’t available in the current version of Chrome but will be added in the ‘medium-term’ future. I’m quite interested in the built-in PDF reader which runs in a security sandbox – I think that’s an excellent idea.

Plus the fact they force Flash updates and don’t even require user confirmation. I think that’s fair enough to keep everyone safe and up-to-date, assuming they’ve installed Flash support in the first place and it’s not being forced on them.

The whole architecture of Chrome is more secure and due to the threading is actually more stable too (if one tab hangs, it doesn’t kill the whole process). Plus it’s very fast rendering pages.

Site: The Register

Posted in: Countermeasures, Exploits/Vulnerabilities, Web Hacking

, , ,


Latest Posts:


Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.
Vulhub - Pre-Built Vulnerable Docker Environments For Learning To Hack Vulhub – Pre-Built Vulnerable Docker Environments For Learning To Hack
Vulhub is an open-source collection of pre-built vulnerable docker environments for learning to hack. No pre-existing knowledge of docker is required, just execute two simple commands.
LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc


Comments are closed.