Vulnerabilities / Threats
12/9/2011
02:19 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google-Sponsored Study Touts Chrome Security

Accuvant Lab's browser security study compared Mozilla Firefox, Google Chrome, and Microsoft Internet Explorer.

Firefox 8 Beta: Visual Tour
Firefox 8 Beta: Visual Tour
(click image for larger view and for slideshow)
A Google-commissioned study has come to the conclusion that Google Chrome is, or was at the point in time when tests were conducted, "the Web browser that is most secured against attack."

Accuvant Labs, at Google's behest, compared Mozilla Firefox, Google Chrome, and Microsoft Internet Explorer. Rather than looking at vulnerability report counts and URL blacklists as ways to measure browser security, the company focused on account security architecture and anti-exploitation technology.

"[W]hile Google funded the research for this paper, Accuvant Labs was given a clear directive to provide readers with an objective understanding of relative browser security," the security company says in its report.

Researcher Joshua Drake said in an email that Apple's Safari browser wasn't included because the study focused on the most widely used browsers today, citing statistics compiled by W3schools.com.

The versions tested were Chrome 12 and 13, Firefox 5.0.1, and Internet Explorer 9; tests were conducted in July, 2011, and do not reflect changes made since then.

[ Concerned about insider threats? Read How To Spot Malicious Insiders Before Data Theft. ]

Chrome, Firefox, and Internet Explorer each implement forms of anti-exploitation technology, but Accuvant suggests Chrome's protection methods are more complete than those used by the other two browser vendors. The firm says that Firefox falls short because doesn't yet support JIT hardening.

JIT (just-in-time) engines in Web browsers take code that has to be interpreted, like JavaScript, and converts it in memory to native binary code for execution. When this code produces predictable patterns, an attacker may be able to identify those patterns and alter the code maliciously. JIT hardening provides a way to mitigate such threats.

As for Internet Explorer, Accuvant suggests that its plug-in security and sandboxing architecture are less comprehensive than Chrome's.

Google is understandably pleased about Accuvant's findings. "We built Chrome with security as one of the core tenets and continue to work actively with the top minds in the security community," a company spokesperson said in an emailed statement. "We believe that many of the security approaches we've integrated into Chrome help to set it apart."

Johnathan Nightingale, Mozilla's director of Firefox engineering, meanwhile says his company is proud of its reputation for security and that security remains a central priority for Firefox. "Firefox includes a broad array of technologies to eliminate or reduce security threats, from platform-level features like address space randomization to internal systems like our layout frame poisoning system," he said in an email. "Sandboxing is a useful addition to that toolbox that we are investigating, but no technology is a silver bullet. We invest in security throughout the development process with internal and external code reviews, constant testing and analysis of running code, and rapid response to security issues when they emerge."

Microsoft didn't immediately respond to a request for comment.

-- Thomas Claburn

Read our report on how to guard your systems from a SQL attack. Download the report now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
12/9/2011 | 10:59:43 PM
re: Google-Sponsored Study Touts Chrome Security
For readers: NSS Labs says IE 9 is the best in terms of security; Accuvant says Chrome. Which browser do you think has the best approach?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8893
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) mainpage.jsp and (2) GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-8894
Published: 2015-01-28
Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter.

CVE-2014-8895
Published: 2015-01-28
IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL.

CVE-2014-8917
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media A...

CVE-2014-8920
Published: 2015-01-28
Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.