Chrome is said to have lost its shine

by Steve Ragan - Sep 4 2008, 11:38

Fame is but a fickle mistress. On Tuesday, Google’s new toy, the Web browser known as Chrome, was seemingly king of the world. Now, thanks to some detailed clock cleaning, Google’s browser is reported to be riddled with security problems. Not so fast, before you set the little-browser-that-could on fire, take some time to think things through.

Chrome is said to have some security issues...one of them is an outdated WebKit.(IMG:Google)

The first thing to remember is that Chrome is open-source and, as such, Google knows security researchers will pick apart its browser and outline all its flaws. This is one of the main reasons for releasing it as an open-source product. With that said, Google should have known better than to release its Chrome browser with a less than polished version of Apple’s WebKit. The current version of Chrome uses Apple’s WebKit version 525.13.This version, according to researcher Aviv Raff, was used in the Windows beta of Safari 3.1, the same version that was vulnerable to the carpet bombing attack -- Chrome uses Safari 3.1 as the rendering engine, which is why if your Web site works in Safari, then Chrome will display it properly. Apple fixed the issue through its Safari 3.2 update. However, Chrome appears to be a version late and a dollar short in keeping up.Aviv Raff created a proof-of-concept (PoC) to show how Chrome can be exploited: “This PoC will automatically download a JAR file and place it in the downloads folder (there are reports that in some cases it will download it to the Desktop, as in Safari. In those cases, the Safari-Pwns-IE exploit can be easily converted to Chrome-Pwns-IE exploit),” Raff said. “Unfortunately, whenever Google Chrome downloads a file, it creates a download bar at the bottom of the page, which seems, for the untrained eye, as part of the page. The downloaded filename is displayed as a button, and the one click on this button will execute the file.”The problem is that this vulnerability requires the user to download a file they are unaware of, and then execute it. At the same time, there are safeguards and warnings. “If the file is an executable (e.g. .EXE, .BAT, etc.), Windows Explorer will show a warning that this file was downloaded from the Internet. In this case, Google Chrome does a good job by setting the Zone.Identifier in the alternative data stream,” Raff points out.This is not the only 'security' issue posed. Another bug, discovered by Rishi Narang, can cause the browser to crash (a denial of tabs and service, if you will) simply because of a “%” character in the URL.Google's browser is still clean and has many positive features. However, as long as there are outdated engines and some bugs in the code, then it will never top or compete too seriously with the likes of Mozilla's Firefox or Microsoft's Internet Explorer. Considering that Chrome is more Google App-focused at present anyway, why would someone switch to Chrome full time? Are people really using this as a steady browser, conducting online banking or other critical uses? Granted, Chrome is EV SSL compliant. As mentioned in the TTH Chrome review, it offers a nice break from tradition when surfing the Web. Use it for what it is, a slick browser that will help manage almost the entire Google line of services as well as allow you to visit normal non-critical Web sites. If you need to do research of a security nature, business, or sensitive work online, then use Firefox or Internet Explorer, at least until Google releases the full and final version of Chrome.

Talkback

Add your comment (no registration required)

page: 1 2

SamSep 4th, 2008 - 12:11:41

Google Chrome and Google based search engine www.treehoo.com are a perfect combination if you want to save the planet while surfing...

Report this comment

mattSep 4th, 2008 - 12:19:56

what Crap,
everyone who has downloaded and used Chrome knows its an amazing super fast browser. Unlike Ie or firefox - which when crashed the whole browser crashes ,chrome just shuts down the crashed tab. Its a breath of fresh air for anyone who wants reliability.
Many of these posts against chrome have some major bias and i am sure microsoft is paying some influential bloggers ridicule Chrome cause its a major threat to them.

Report this comment

mohammed najeeb uddinSep 4th, 2008 - 12:24:59

chrome is the best!

Report this comment

Arup Kumar NathSep 4th, 2008 - 12:42:55

Chrome looks great...

Report this comment

MikeSep 4th, 2008 - 12:57:19

I think Chrome's biggest security hole for the average user is its EULA. Google owns something I made simply because I used Chrome to post it on the internet? Forget it.

Would you use a browser that explicitly says that anything you post using that browser can instantly end up in someone else's hands? If you use Chrome, thats exactly what you are doing.

I was so excited when I heard Google was coming out with a browser. And it looked and worked great. Pity I've already had to uninstall it.

Report this comment

BrentSep 4th, 2008 - 12:57:29

Chrome is far better then any other browser out there. It's fast, it's easy to use and was built from the ground up with great programming practices.

Report this comment

Steve Ragan - TTHSep 4th, 2008 - 13:12:20

The 'jail' feature is indeed great. However, as in the crash example, all the tabs die and will not recover. I would ask if this counts as a security or design flaw. The problem is that forced crashes can sometimes betaken advantage of to execute code...Chrome is a great tool if you are a heavy user of the Google services and do mostly simple Internet tasks. However, it is not Firefox nor is it Internet Explorer and in its present state will never match either one.

I don't know about Microsoft paying 'bloggers' to report negatively, but I do know that some Microsoft employees have used Chrome and love it. Regarding the EULA, I've stayed away from the topic as I do not want to start a debate over policy. However, if you do not like the EULA, stop using the service no one is dependent on Google's Chrome or the EULA at the moment, maybe with some time they will change it. (Unlike the EULA for MS which we are mostly stuck with unless you use 'Nix or OS X.)

Report this comment

ScottSep 4th, 2008 - 13:18:31

Actually I tried chrome and it crashed (the whole thing not just the tab) on me about 4 times so I gave up. It's certainly isn't faster then Firefox for regular web pages - but appears to be for Javascript (which makes sense)

The short answer is yet again, we have a new browser = more confusion and testing for users and developers - that is batter at some things and worse at others then all the rest.

Report this comment

sanjeevSep 4th, 2008 - 13:24:49

I tried chrome.. and simply it is not cup of tea!

- Look didnt excite me
- popup blocking is not good.
- try downloading a file thru chrome. everytime you will find a new bug.
- options bar could have had more options!
- secured website access - warnings and notifications are bit strange. They appear as if you are going thru a step-by-step install process.

Report this comment

vishavSep 4th, 2008 - 13:38:39

As the google's product makes the word rock.....this is just addition to that....
imaging

Report this comment

page: 1 2

Add your comment (no registration required)

Security

Chrome is said to have lost its shine

Talkback

Latest

In The Tech Herald

Site

The Fine Print