[ad]
It’s good news to see that Google is taking security issues seriously when it comes to its Chrome browser. This has been shown before when Google was Willing To Pay Bounty For Chrome Browser Bugs. And well honestly, we haven’t had a lot of news of exploits in Chrome.
Perhaps it’s because the user-base just isn’t that big yet? But to note, Chrome was the only browser in the recent Pwn2Own contest that did not get exploited.
Anyway the story is in this case, Chrome is taking a leaf from the book of Firefox and is planning to add the ability to block out-of-date plug-ins in the browser.
Google will soon prevent insecure versions of plug-ins from running on top of its Chrome browser to make sure they don’t contain security bugs that can be exploited by malicious websites.
In a blog post, members of Google’s security team said the feature, to be delivered “medium-term,” will prevent Chrome from running “certain out-of-date plug-ins.” It will also help users find updates.
The announcement comes a few months after anti-virus maker F-Secure said Adobe’s Reader application replaced Microsoft Word as the program that’s most often exploited in targeted malware campaigns, like the one that Google disclosed in January that exposed sensitive intellectual property. F-Secure said the increase is “primarily because there has been more vulnerabilities in Adobe Acrobat/Reader than in the Microsoft Office applications.” Other plug-ins such as Adobe’s Flash Player and Oracle’s Java Virtual Machine are also routinely attacked.
Firefox demonstrated the use of this function last October when Firefox Blocked the Microsoft .NET Framework Assistant Add-on.
It is important as there are so many Flash vulnerabilities, problems with PDF plug-ins and so on that the ability to disable/block plug-ins is indeed useful.
Plus there are so many user/3rd party contributed add-ons and plug-ins the browser developers do need a way to control them if they wish to retain a good level of browser security.
The ability to run scores of browser plug-ins makes it hard for users to keep their systems fully patched. Mozilla recently addressed this problem by notifying users who run out-of-date add-ons on top of Firefox. Google seems to be going one step further by blocking them altogether.
“Since many plug-ins are ubiquitous, they pose the most significant risk to our user base,” the Google employees wrote.
The auto-blocking will join several other security features being baked into Chrome. Chief among them is a home-grown PDF reader integrated into Chrome that sports its own security sandbox. This is now available in a developer build. The stable Chrome includes a built-in Flash plug-in that Google will automatically update via the browser’s existing update mechanism, which does not ask for the user’s approval.
Chrome has long boasted one of the most advanced sandbox designs, which thwarts attacks by running individual windows and plug-ins in a separate process with limited access to the operating system kernel. Chrome was the only browser at the recent Pwn2Own hacker contest that wasn’t exploited.
The feature isn’t available in the current version of Chrome but will be added in the ‘medium-term’ future. I’m quite interested in the built-in PDF reader which runs in a security sandbox – I think that’s an excellent idea.
Plus the fact they force Flash updates and don’t even require user confirmation. I think that’s fair enough to keep everyone safe and up-to-date, assuming they’ve installed Flash support in the first place and it’s not being forced on them.
The whole architecture of Chrome is more secure and due to the threading is actually more stable too (if one tab hangs, it doesn’t kill the whole process). Plus it’s very fast rendering pages.
Site: The Register