One of the major challenges for any browser's security architecture is maintaining compatibility with existing...
By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.
Web content. Google Chrome must support plug-ins, such as Flash Player and Silverlight, but these plug-ins are not designed to run in a sandbox. They require direct access to the operating system and peripherals, such as the user's webcam and microphone. This means Chrome can't currently run them in a sandbox. Compatibility challenges also exist when trying to enforce the same-origin policy, which isolates websites from each other. Chrome has to sometimes place pages from different origins in the same process.
Several of Google Chrome security features for Windows, have been introduced in recent versions of Microsoft's operating system, such as data execution prevention, address space layout randomization, safe exception handlers, heap corruption detection and stack overrun detection. However, Chrome's initial line of defense, like other browsers, is to check visited sites against antimalware and antiphishing blacklists, displaying a warning page if the site has been reported to StopBadware.org.
As you can see, Google has tried to make security simple for Chrome users, which is never an easy task as security is normally inverse to usability. But there are some areas where usability over security may have gone too far. By default, when there is secure and non-secure content on an SSL page, all content is loaded with no warning. Of more concern, is that automatic checking for server certificate revocation is not enabled by default -- this issue caused a problem recently for phones running Symbian's OS.
Right now, IE and Firefox are mature, fairly secure browsers while Chrome hasn't yet been thoroughly put to the test, so there's an argument for waiting for version 2.0. After that, unless Google comes up with something really new, I think your choice of browser from a security standpoint will come down to who is quickest and most effective at fixing any security vulnerabilities as they are found. Interestingly, Google has published the full source code for Chrome, possibly giving it the potential to be more secure than its closed-source counterparts as security researchers can spot and fix security vulnerabilities.
Dig Deeper on Web Browser Security
Related Q&A from Michael Cobb
Is cookie encryption enough to protect sensitive information? Expert Michael Cobb explains how salted hashes can prevent attacks, and the secure way ...continue reading
A vulnerability was found in the Blackphone's Icera modem. Expert Michael Cobb explains how attackers could hijack the device, and if this would ...continue reading
Oracle is killing off the Java browser plug-in due to security risks. Expert Michael Cobb explains the next steps for enterprises with Java-based ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.