Google unveils its own Web browser

As we reported yesterday, Google has released the first beta of their new web browser, Google Chrome. Within a day of its release, there are already a couple of points that users should be cautioned of before using this new browser.

The first, is the popular "carpet bomb" vulnerability that still exists within Chrome, as pointed out on our forums by our member matessim. This vulnerability allows malicious websites to drive by download and execute programs on your machine. Our visitors may remember the uproar that this same vulnerability caused for Safari users, and that Apple patched the carpet-bombing issue with Safari v3.1.2. Chrome is vulnerable to this exploit because it is based on the same engine, WebKit 525.13, and Google did not patch or update the engine before releasing the software.

The other, and less technical, problem with Chrome exists in its EULA. More specifically, the point that would seem to give Google rights to anything you post on the Internet while using their browser, mostly in conjunction with the promotion of its services.

Google Chrome and Internet Explorer 8 herald a new, resource-intensive era in Web browsing, one sure to shift our conception of acceptable minimum system requirements, InfoWorld's Randall Kennedy concludes in his head-to-head comparison of the recently announced multi-process, tabbed browsers. Whereas single-process browsers such as Firefox aim for lean, efficient browsing experiences, Chrome and IE 8 are all about delivering a robust platform for reliably running multiple Web apps in a tabbed format in answer to the Web's evolving needs. To do this, Chrome takes a 'purist' approach, launching multiple, discrete processes to isolate and protect each tab's contents. IE 8, on the other hand, goes hybrid, creating multiple instances of the iexplore.exe process without specifically assigning each tab to its own instance. 'Google's purist approach will ultimately prove more robust,' Kennedy argues, 'but at a cost in terms of resource consumption.' At what cost? Kennedy's comparison found Chrome 'out-bloated' IE 8, consuming an average of 267MB vs. IE 8's 211MB. This, and recent indications that IE 8 itself consumes more resources than Vista, surely announce a new, very demanding era in Web-centric computing.

The first thing to remember is that Chrome is open-source and, as such, Google knows security researchers will pick apart its browser and outline all its flaws. This is one of the main reasons for releasing it as an open-source product. With that said, Google should have known better than to release its Chrome browser with a less than polished version of Apple’s WebKit. The current version of Chrome uses Apple’s WebKit version 525.13.

This version, according to researcher Aviv Raff, was used in the Windows beta of Safari 3.1, the same version that was vulnerable to the carpet bombing attack -- Chrome uses Safari 3.1 as the rendering engine, which is why if your Web site works in Safari, then Chrome will display it properly. Apple fixed the issue through its Safari 3.2 update. However, Chrome appears to be a version late and a dollar short in keeping up.

Aviv Raff created a proof-of-concept (PoC) to show how Chrome can be exploited:

“This PoC will automatically download a JAR file and place it in the downloads folder (there are reports that in some cases it will download it to the Desktop, as in Safari. In those cases, the Safari-Pwns-IE exploit can be easily converted to Chrome-Pwns-IE exploit),” Raff said.

“Unfortunately, whenever Google Chrome downloads a file, it creates a download bar at the bottom of the page, which seems, for the untrained eye, as part of the page. The downloaded filename is displayed as a button, and the one click on this button will execute the file.”

"llama66" said
now that you mention it, it does use quite a bit of memory.

"Scape" said
Enable Chrome's Best Features in Firefox


http://arstechnica.com/news.ars/post/20 ... ge-it.html
Google on Chrome EULA controversy: our bad, we'll change it

It's worth noting that the EULA is largely unenforceable because the source code of Chrome is distributed under an open license. Users could simply download the source code, compile it themselves, and use it without having to agree to Google's EULA. The terms of the BSD license under which the source code is distributed are highly permissive and impose virtually no conditions or requirements on end users.

So, there you have it: a tempest in a (chrome) teapot. Not that it's the only one; as Ina Fried of News.com points out, Chrome's "Omnibar" can also access all keystrokes a user types, and Google will store some of this information along with IP addresses.