One of the major challenges for any browser's security architecture is maintaining compatibility with existing...
Web content. Google Chrome must support plug-ins, such as Flash Player and Silverlight, but these plug-ins are not designed to run in a sandbox. They require direct access to the operating system and peripherals, such as the user's webcam and microphone. This means Chrome can't currently run them in a sandbox. Compatibility challenges also exist when trying to enforce the same-origin policy, which isolates websites from each other. Chrome has to sometimes place pages from different origins in the same process.
Several of Google Chrome security features for Windows, have been introduced in recent versions of Microsoft's operating system, such as data execution prevention, address space layout randomization, safe exception handlers, heap corruption detection and stack overrun detection. However, Chrome's initial line of defense, like other browsers, is to check visited sites against antimalware and antiphishing blacklists, displaying a warning page if the site has been reported to StopBadware.org.
As you can see, Google has tried to make security simple for Chrome users, which is never an easy task as security is normally inverse to usability. But there are some areas where usability over security may have gone too far. By default, when there is secure and non-secure content on an SSL page, all content is loaded with no warning. Of more concern, is that automatic checking for server certificate revocation is not enabled by default -- this issue caused a problem recently for phones running Symbian's OS.
Right now, IE and Firefox are mature, fairly secure browsers while Chrome hasn't yet been thoroughly put to the test, so there's an argument for waiting for version 2.0. After that, unless Google comes up with something really new, I think your choice of browser from a security standpoint will come down to who is quickest and most effective at fixing any security vulnerabilities as they are found. Interestingly, Google has published the full source code for Chrome, possibly giving it the potential to be more secure than its closed-source counterparts as security researchers can spot and fix security vulnerabilities.
Dig Deeper on Web browser security
Related Q&A from Michael Cobb
Expert Michael Cobb details how to argue for a multistep secure code review process, like Microsoft SDL, and the pros of secure coding practices. Continue Reading
Researchers developed a tool to help prevent improper certificate pinning that causes security issues. Expert Michael Cobb reviews the issue and the ... Continue Reading
Google Project Zero discovered a WPAD attack that could target systems running Windows 10. Expert Michael Cobb explains how the attack works and how ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.