Newsletters Select newsletters below and click the button to sign up!
Internetnews BloggersRecent Entries
ArchivesMonthly ArchivesSearch The Blog
« Is Google Chrome 2.0.180.0 your default browser? |
Sean Michael Kerner Blog
| KDE 4.3.0 Beta 1 shows off the Linux desktop's future »
Google Chrome was at risk from PWN2OWN flaw From the 'so you think you're secure...' files: Last month security researcher 'Nils' hacked IE, Safari and Firefox with zero day flaws -- Google's Chrome was conspicuously absent. Microsoft, Firefox and Apple have now fixed their flaws and guess what? It turns out that Chrome was at risk too. Google revealed late Wednesday that its Chrome stable 1.0.154.65 (released on May 7th) was in fact at risk from the same flaw that took down Safari at PWN2OWN. "Disclosing that this release contains the fix for CVE-2009-0945, an issue in WebKit code that also affects Apple's Safari web browser," Mark Larson Google Chrome Program Manager wrote in an advisory. "We did not want to disclose this until Apple's fix for Safari users was released."Apple updated Safari version 3.x and 4.x yesterday for the WebKit flaw originally discovered by Nils at PWN2OWN. What's really interesting to note here is that it is a flaw in WebKit that was exploited. Since both Safari and Chrome use WebKit both were at risk. This could mean that for an attacker, if they can find a critical flaw in WebKit they could potentially take down two browsers at a time. The practical reality though is that Chrome and Safari can differ in terms of which version of WebKit they use. As well the fact that both browsers use WebKit means even more developers are looking at the code which could mean fewer flaws and faster fixes (or not). 0 TrackBacksListed below are links to blogs that reference this entry: Google Chrome was at risk from PWN2OWN flaw. TrackBack URL for this entry: https://swarm.jupitermedia.com/mt-tb.cgi/8034 2 CommentsLeave a comment |
||
There is an interesting mythology about competing browsers that parallels competing OSes. The "my platform is safer than your platform" argument never seems to abate.
In actuality, the relative safety over time seems to almost perfectly mirror the evolution of living organisms. Whichever one becomes most prevalent then becomes the target of virus writers. If users of Safari or Chrome succeed in winning over a large market share, they too will suffer the consequences of increased attention of the dark side.
It should be noted that Safari will be less likely to be updated than Chrome, because of the difference between Safari's update mechanism and Chrome's silent updater.
So as flaws are found, most Chrome users will be protected by patches, most without the knowledge that a patch has taken place.
Of course this still doesn't protect against severe zero-day exploits.