One of the major challenges for any browser's security architecture is maintaining compatibility with existing Web content. Google Chrome must support plug-ins, such as Flash Player and Silverlight, but these plug-ins are not designed to run in a sandbox. They require direct access to the operating system and peripherals, such as the user's webcam and microphone. This means Chrome can't currently run them in a sandbox. Compatibility...
challenges also exist when trying to enforce the same-origin policy, which isolates websites from each other. Chrome has to sometimes place pages from different origins in the same process.
Several of Google Chrome security features for Windows, have been introduced in recent versions of Microsoft's operating system, such as data execution prevention, address space layout randomization, safe exception handlers, heap corruption detection and stack overrun detection. However, Chrome's initial line of defense, like other browsers, is to check visited sites against antimalware and antiphishing blacklists, displaying a warning page if the site has been reported to StopBadware.org.
As you can see, Google has tried to make security simple for Chrome users, which is never an easy task as security is normally inverse to usability. But there are some areas where usability over security may have gone too far. By default, when there is secure and non-secure content on an SSL page, all content is loaded with no warning. Of more concern, is that automatic checking for server certificate revocation is not enabled by default -- this issue caused a problem recently for phones running Symbian's OS.
Right now, IE and Firefox are mature, fairly secure browsers while Chrome hasn't yet been thoroughly put to the test, so there's an argument for waiting for version 2.0. After that, unless Google comes up with something really new, I think your choice of browser from a security standpoint will come down to who is quickest and most effective at fixing any security vulnerabilities as they are found. Interestingly, Google has published the full source code for Chrome, possibly giving it the potential to be more secure than its closed-source counterparts as security researchers can spot and fix security vulnerabilities.
Dig Deeper on Web Browser Security
Related Q&A from Michael Cobb
Pretty Good Privacy is nearly 25 years old and still widely used -- but is it as effective as it once was? Application security expert Michael Cobb ...continue reading
Homomorphic encryption can be used to bypass encryption, but it's for the good of all. Application security expert Michael Cobb explains.continue reading
Expert Michael Cobb explains how password change frequency and reuse for third-party apps should be addressed in enterprise password policies.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.