Google Chrome again…
Actually, I really like it. It’s way, way faster than Firefox 3 or IE7 or 8, for initial launches and individual page loads.
Though I made fun of the comic book, it does cover a lot more info than I remember Mozila or the IE team ever releasing on the architectures of their browsers - and Opera? Forget it. They cover a lot of interesting points for the user, the developer, and the security guy. I’m impressed by all of it.
Google Chrome is, though, a web browser, which means that it is inevitably a huge and complex piece of software riddled with security defects. Since it’s new, we don’t know what any of them are, though! They are there, though, and they’ll jump out at us pretty rapidly.
Here’s one, via Zero Day and Evil Fingers.
“An issue exists in how chrome behaves with undefined-handlers in chrome.dll version 0.2.149.27. A crash can result without user interaction. When a user is made to visit a malicious link, which has an undefined handler followed by a ’special’ character, the chrome crashes with a Google Chrome message window “Whoa! Google Chrome has crashed. Restart now?”
This is bad enough we’ll see it patched really soon. The problem isn’t just that a malicious URL can crash the browser, it’s the risk that the crash could lead to a stack overflow. They’re using ASLR - address space layout randomization - which makes that kind of attack harder to mount.
The second issue Zero Day cites was a big flaming red flag when it showed up in Safari - the ability of a malicious site to drop files onto the desktop. The Google proof-of-concept exploit may not seem as bad as the Safari carpet-bombin issue, since the user currently has to OK the desktop file save. Aviv Raff’s exploit is an interesting combination of old attacks on aging components incorporated into Chrome and a brand-new vulnerability fresh from Black Hat 2008.
SOOO…
I’d continue to use Firefox for your everyday casual browsing needs. Chrome won’t be safe for a while yet - no new browser could be. IE7 isn’t bad, and IE8 will be pretty good.
