Early security issues tarnish Google's Chrome

Researchers have already found two security problems with Google's new Chrome browser.

Google's new Chrome Web browser plagued with security problems

Google's new Chrome Web browser plagued with security problems

Security researchers have reported finding vulnerabilities in Google's new Web browser a day after it was released in beta.

One vulnerability would allow hackers to crash the browser. Security researcher Rishi Narang described the issue on the SecuriTeam Web site and posted a proof of concept at Evilfingers. According to Narang, a hacker could build a malicious link that includes an undefined handler followed by a certain character. When a user clicks on the link, Chrome crashes.

Another, potentially more serious vulnerability could result in Chrome users downloading malicious code. The problem is due, in part, to the fact that Google uses an older version of WebKit, the open-source browser technology also used in Apple's Safari browser, that includes the vulnerability.

Discovered by researcher Aviv Raff, the problem lies in the way Chrome downloads files and the way Windows handles the downloaded files, he said.

Chrome's default setting downloads files into a folder. It then displays a download bar at the bottom of the browser page. Users click on the bar to open the file. If the file is an executable, Windows displays a warning, which can help users avoid inadvertently downloading malicious code.

If the file is a JAR (Java Archive), however, it isn't treated like other executables, Raff said. When a user clicks on that download bar, instead of displaying a warning, Windows automatically runs the file.

The problem is exacerbated by the way the download bar looks, Raff said. The bar appears to be part of the Web page. In a proof of concept that Raff posted, users might think they're clicking on a link or a button on the page, rather than opening up a downloaded file.

"This is again a sort of a 'blended threat'," he wrote in a blog post. "Two small issues in different products, when blended together, create a much larger problem."

He thinks Google might face other, similar issues in the future because Chrome uses technologies from different browsers, including Apple's Safari and Mozilla's Firefox.

"Security wise, it's very problematic," Raff wrote. "They'll have to track all security vulnerabilities in those features, and fix them in Chrome too. This will probably be only after those vulnerabilities were fixed by the other vendors or were publicly reported. It will put Chrome users at risk for a long time."

Google did not directly address questions about this vulnerability or whether it plans to make any changes to Chrome to prevent any potential problems. Instead, a Google spokeswoman said in a statement that, by default, Chrome downloads files into a separate folder instead of on the user's desktop as a way to avoid some security problems. In addition, she said that users can set the browser to ask where to save each file before downloading it.

She also did not say whether Google intends to upgrade to the more recent version of WebKit, which addresses the problem by displaying a dialog box for JAR files asking users if they want to download them.

Join the PC World newsletter!

Error: Please check your email address.

Tags Google Chrome

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Nancy Gohring

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?