Google fixes two critical Chrome flaws

By Justin ยท 10 replies
Aug 25, 2009
  1. Update: We mistakenly reported earlier that one of the flaws in the Chrome browser could have lead to system-wide code execution. As one of its most significant built-in security measures, the Chrome browser adds an extra layer of security for HTML rendering and JavaScript execution called the sandbox. In other words, while the reported vulnerability could have resulted in unauthorized code execution, it would have been confined to the boundaries of the sandbox, according to Google's release documentation.

    Read the whole story
  2. strategic

    strategic TechSpot Paladin Posts: 1,020

    Interesting, I wonder if this has anything to do with Google being so "nosy"...
  3. red1776

    red1776 Omnipotent Ruler of the Universe Posts: 5,224   +164

    doesn't Mozilla get its funding from Google? or did I misunderstand that in the past?
  4. Matthew

    Matthew TechSpot Staff Posts: 5,333   +101

    @red1776: Last I knew, the two had an agreement over Google being the default search provider for Firefox. I'm pretty sure they still have that locked down for a few years (unless something has changed). The last time I read anything about it (6+ months ago I believe) that deal made up some 80-90% of Mozilla's income.
  5. strategic

    strategic TechSpot Paladin Posts: 1,020

    I guess you're right Red, I never knew that until I found this article.

    Through revenue that comes from search ads, Google supplied Mozilla with $66 million of its $75 million in 2007 revenue, the last year for which figures are publicly available.
  6. red1776

    red1776 Omnipotent Ruler of the Universe Posts: 5,224   +164

    Thanks Matthew:),
    i was just wondering then why it would be so 'interesting' that the Mozilla team would have discovered the flaw since they are financially joined ,and have a common interest in each others success.
  7. There are two problems with this article:
    * The flaws are rated "High", not "Critical". Perhaps your choice of "critical" was casual, but as it's a meaningful security rating, it's misleading.
    * The flaws could not result in direct system compromise and arbitrary code execution because they were contained by the sandbox. Black hats would also need a flaw in the sandbox to break out of it, combined with one of these flaws, to do real damage. This is precisely why we created the sandbox: to provide defense in depth.

    --Peter Kasting, Chromium developer
  8. AndrestheBean

    AndrestheBean TS Rookie Posts: 207

    i get the feeling this guy is important.
  9. I'm glad someone noticed the collaboration with Mozilla. There's a surprisingly large amount of behind-the-scenes collaboration between browser vendors. For example, this blog post illustrates some of the bi-directional sharing between Google and the other browser vendors:

    Chris Evans, Chrome Security Team
  10. Julio Franco

    Julio Franco TechSpot Editor Posts: 7,674   +990

    @Guest (Peter) - Thank you for your feedback. We have updated the original post with a proper correction.
  11. Phantasm66

    Phantasm66 TS Rookie Posts: 5,734   +8

    That's cool you saw the article and corrected it Peter.
Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...