TechSpot

Google fixes two critical Chrome flaws

By Justin
Aug 25, 2009
  1. Update: We mistakenly reported earlier that one of the flaws in the Chrome browser could have lead to system-wide code execution. As one of its most significant built-in security measures, the Chrome browser adds an extra layer of security for HTML rendering and JavaScript execution called the sandbox. In other words, while the reported vulnerability could have resulted in unauthorized code execution, it would have been confined to the boundaries of the sandbox, according to Google's release documentation.

    Read the whole story
     
  2. strategic

    strategic TechSpot Paladin Posts: 1,274

    Interesting, I wonder if this has anything to do with Google being so "nosy"...
     
  3. red1776

    red1776 Omnipotent Ruler of the Universe Posts: 5,911   +91

    doesn't Mozilla get its funding from Google? or did I misunderstand that in the past?
     
  4. Matthew

    Matthew TechSpot Staff Posts: 6,087   +84 Staff Member

    @red1776: Last I knew, the two had an agreement over Google being the default search provider for Firefox. I'm pretty sure they still have that locked down for a few years (unless something has changed). The last time I read anything about it (6+ months ago I believe) that deal made up some 80-90% of Mozilla's income.
     
  5. strategic

    strategic TechSpot Paladin Posts: 1,274

    I guess you're right Red, I never knew that until I found this article.

    Through revenue that comes from search ads, Google supplied Mozilla with $66 million of its $75 million in 2007 revenue, the last year for which figures are publicly available.
     
  6. red1776

    red1776 Omnipotent Ruler of the Universe Posts: 5,911   +91

    Thanks Matthew:),
    i was just wondering then why it would be so 'interesting' that the Mozilla team would have discovered the flaw since they are financially joined ,and have a common interest in each others success.
     
  7. There are two problems with this article:
    * The flaws are rated "High", not "Critical". Perhaps your choice of "critical" was casual, but as it's a meaningful security rating, it's misleading.
    * The flaws could not result in direct system compromise and arbitrary code execution because they were contained by the sandbox. Black hats would also need a flaw in the sandbox to break out of it, combined with one of these flaws, to do real damage. This is precisely why we created the sandbox: to provide defense in depth.

    --Peter Kasting, Chromium developer
     
  8. AndrestheBean

    AndrestheBean TS Rookie Posts: 217

    i get the feeling this guy is important.
     
  9. I'm glad someone noticed the collaboration with Mozilla. There's a surprisingly large amount of behind-the-scenes collaboration between browser vendors. For example, this blog post illustrates some of the bi-directional sharing between Google and the other browser vendors:

    http://googleonlinesecurity.blogspot.com/2009/07/improving-web-browser-security.html

    Chris Evans, Chrome Security Team
     
  10. Julio Franco

    Julio Franco TechSpot Editor Posts: 6,594   +352

    @Guest (Peter) - Thank you for your feedback. We have updated the original post with a proper correction.
     
  11. Phantasm66

    Phantasm66 TS Rookie Posts: 6,504   +6

    That's cool you saw the article and corrected it Peter.
     
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.