Skip to Content
Uncategorized

Chrome’s Security Crown Slips

A security firm claims to have found a way to use Google’s browser to attack web users.

Google’s browser Chrome may have just suffered its most serious security setback yet. Security firm VUPEN today announced that its researchers had found a way to have a webpage run any code or program it wants on a Chrome user’s Windows computer.

A video shows how visiting the attacking webpage enables it to download and then execute a calculator program–a standard method of demonstrating how an attack works. If the vulnerability were exploited in the wild it could be used to install programs that steal passwords, or make a computer part of a network of infected computers used to attack websites.

VUPEN hasn’t made the exact details of the hack public, saying only that it required “one of the most sophisticated codes we have seen” and that it will relay the details to government agencies on its customer list. According to the company’s statement:

“This code and the technical details of the underlying vulnerabilities will not be publicly disclosed. They are shared exclusively with our Government customers as part of our vulnerability research services.”

VUPEN provides law enforcement and intelligence agencies with what it dubs “weaponized” exploits for surveillance or other covert operations. The company has made no mention of whether Google was warned of today’s announcement, or how it will be helped to fix the exploit.

Google has promoted Chrome since its launch as offering superior security to other browsers. Chrome has never been defeated at the annual Pwn2Own contest that challenges the world’s best hackers to compromise popular software. At this year’s event in March, Firefox and Chrome were the only two popular browsers not defeated.

VUPEN’s attack is the first to beat a feature of Chrome called “sandboxing” that carefully isolates web code in different tabs from each other, and the rest of a person’s computer. The new attack is able to somehow bust out of the sandbox to download and execute any code it wishes. Another of Chrome’s security features will help it minimize the risk to users, though. Unlike most software, the browser silently upgrades itself to the most recent version without a person’s permission whenever possible. That habit will enable the fix to Google’s new security hole to spread fast, once it has been worked out.

Keep Reading

Most Popular

Workers disinfect the street outside Shijiazhuang Railway Station
Workers disinfect the street outside Shijiazhuang Railway Station

Why China is still obsessed with disinfecting everything

Most public health bodies dealing with covid have long since moved on from the idea of surface transmission. China’s didn’t—and that helps it control the narrative about the disease’s origins and danger.

individual aging affects covid outcomes concept
individual aging affects covid outcomes concept

Anti-aging drugs are being tested as a way to treat covid

Drugs that rejuvenate our immune systems and make us biologically younger could help protect us from the disease’s worst effects.

Europe's AI Act concept
Europe's AI Act concept

A quick guide to the most important AI law you’ve never heard of

The European Union is planning new legislation aimed at curbing the worst harms associated with artificial intelligence.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.