Google's Chrome, Apple's Safari Shared Vulnerability

[B.SkiLLs]

Google's Chrome, Apple's Safari Shared Vulnerability




Larry Seltzer - PC Magazine Wed Sep 3, 7:06 AM ET

Google's new browser, Chrome, has quite a few security-related features:

    * Site blacklists to protect against malware and phishing

    * A privacy mode (Incognito) to erase tracks of user activity.

    * A thorough Clear Browsing Data dialog box.


 

But the really innovative feature in Chrome is the way Google has built the browser's rendering engine to run in a sandbox. Each browser tab is an isolated process running with limited capabilities. This means that if a malicious application were to run, it could not crash, interfere with or impede the others running in other tabs. It also means that the app cannot do things, like write to the file system, that could make the malicious app persistent.

It's a laudable goal, but unfortunately there are already demonstrable holes in the sandbox. Chrome, for example, has already been demonstrated to be vulnerable to the Apple Safari "Carpet Bombing" vulnerability. The new version of the attack drops files in the Chrome download folder; the user would have to be persuaded to run them via a social engineering attack. This may or may not be practical, but the sandbox did fail.

Why did it fail? Because Chrome is built on open source code from other platforms, including Apple's WebKit. Google specifically used a version of WebKit prior to the fix for the Carpet Bombing bug. Par for the course with some open source projects.