Google Chrome Set To Follow Firefox In Blocking Out-of-date Plug-ins


It’s good news to see that Google is taking security issues seriously when it comes to its Chrome browser. This has been shown before when Google was Willing To Pay Bounty For Chrome Browser Bugs. And well honestly, we haven’t had a lot of news of exploits in Chrome.

Perhaps it’s because the user-base just isn’t that big yet? But to note, Chrome was the only browser in the recent Pwn2Own contest that did not get exploited.

Anyway the story is in this case, Chrome is taking a leaf from the book of Firefox and is planning to add the ability to block out-of-date plug-ins in the browser.

Google will soon prevent insecure versions of plug-ins from running on top of its Chrome browser to make sure they don’t contain security bugs that can be exploited by malicious websites.

In a blog post, members of Google’s security team said the feature, to be delivered “medium-term,” will prevent Chrome from running “certain out-of-date plug-ins.” It will also help users find updates.

The announcement comes a few months after anti-virus maker F-Secure said Adobe’s Reader application replaced Microsoft Word as the program that’s most often exploited in targeted malware campaigns, like the one that Google disclosed in January that exposed sensitive intellectual property. F-Secure said the increase is “primarily because there has been more vulnerabilities in Adobe Acrobat/Reader than in the Microsoft Office applications.” Other plug-ins such as Adobe’s Flash Player and Oracle’s Java Virtual Machine are also routinely attacked.

Firefox demonstrated the use of this function last October when Firefox Blocked the Microsoft .NET Framework Assistant Add-on.

It is important as there are so many Flash vulnerabilities, problems with PDF plug-ins and so on that the ability to disable/block plug-ins is indeed useful.

Plus there are so many user/3rd party contributed add-ons and plug-ins the browser developers do need a way to control them if they wish to retain a good level of browser security.

The ability to run scores of browser plug-ins makes it hard for users to keep their systems fully patched. Mozilla recently addressed this problem by notifying users who run out-of-date add-ons on top of Firefox. Google seems to be going one step further by blocking them altogether.

“Since many plug-ins are ubiquitous, they pose the most significant risk to our user base,” the Google employees wrote.

The auto-blocking will join several other security features being baked into Chrome. Chief among them is a home-grown PDF reader integrated into Chrome that sports its own security sandbox. This is now available in a developer build. The stable Chrome includes a built-in Flash plug-in that Google will automatically update via the browser’s existing update mechanism, which does not ask for the user’s approval.

Chrome has long boasted one of the most advanced sandbox designs, which thwarts attacks by running individual windows and plug-ins in a separate process with limited access to the operating system kernel. Chrome was the only browser at the recent Pwn2Own hacker contest that wasn’t exploited.

The feature isn’t available in the current version of Chrome but will be added in the ‘medium-term’ future. I’m quite interested in the built-in PDF reader which runs in a security sandbox – I think that’s an excellent idea.

Plus the fact they force Flash updates and don’t even require user confirmation. I think that’s fair enough to keep everyone safe and up-to-date, assuming they’ve installed Flash support in the first place and it’s not being forced on them.

The whole architecture of Chrome is more secure and due to the threading is actually more stable too (if one tab hangs, it doesn’t kill the whole process). Plus it’s very fast rendering pages.

Site: The Register

Posted in: Countermeasures, Exploits/Vulnerabilities, Web Hacking

, , ,


Latest Posts:


LambdaGuard - AWS Lambda Serverless Security Scanner LambdaGuard – AWS Lambda Serverless Security Scanner
LambdaGuard is a tool which allows you to visualise and audit the security of your serverless assets, an open-source AWS Lambda Serverless Security Scanner.
exe2powershell - Convert EXE to BAT Files exe2powershell – Convert EXE to BAT Files
exe2powershell is used to convert EXE to BAT files, the previously well known tool for this was exe2bat, this is a version for modern Windows.
HiddenWall - Create Hidden Kernel Modules HiddenWall – Create Hidden Kernel Modules
HiddenWall is a Linux kernel module generator used to create hidden kernel modules to protect your server from attackers.
Anteater - CI/CD Security Gate Check Framework Anteater – CI/CD Security Gate Check Framework
Anteater is a CI/CD Security Gate Check Framework to prevent the unwanted merging of filenames, binaries, deprecated functions, staging variables and more.
Stardox - Github Stargazers Information Gathering Tool Stardox – Github Stargazers Information Gathering Tool
Stardox is a Python-based GitHub stargazers information gathering tool, it scrapes Github for information and displays them in a list tree view.
ZigDiggity - ZigBee Hacking Toolkit ZigDiggity – ZigBee Hacking Toolkit
ZigDiggity a ZigBee Hacking Toolkit is a Python-based IoT (Internet of Things) penetration testing framework targeting the ZigBee smart home protocol.


Comments are closed.