Google Chrome Puts Security in a Sandbox

The Google Chrome browser is no longer a beta, and has been outfitted with a coat of security armor Google hopes will both protect users and help Chrome compete with rival browsers.

The toughest piece of that armor involves sandboxing. In Chrome, HTML rendering and JavaScript execution are isolated in their own class of processes. Running each tab in Chrome in a sandbox allows Web applications to be launched in their own browser windows without the ability to write or read files from sensitive areas. Plug-ins are run in separate processes that communicate with the renderer.

"I think Google was very proactive in terms of what we've been doing around trying to help prevent users from being infected with malware," said Ian Fette, security product manager for Google. "On the Web browser, we're trying to do everything we can to make sure that users are not becoming affected with malware, and a big part of that is the sandboxing technology."

Calling it a second level of defense, he said the technology is designed to prevent malware from persisting even if there is a flaw in the code that would lead to the Web browser being compromised.

"It's designed to prevent malware from getting installed on the system, from being able to start again when you close the browser and restart the computer; it's designed to help prevent malware from being able to read files on your file system … it's really a defense-in-depth mechanism," Fette explained.

As noted on the Google security blog, however, there are some limitations. Since it depends on Windows, there is the possibility of a flaw in the operating system security model itself. Another issue is that some legacy file systems used on certain computers and USB keys, such as FAT32, don't support security descriptors. Files on those devices can't be protected by the sandbox, according to the blog.

In addition, if a third-party vendor configures files, registry keys and other objects in a way that bypasses the access check—the mechanism by which the system determines whether the security descriptor of an object grants the rights requested to an access token—it can give everyone using the machine full access.

In addition to the sandboxing, Google has outfitted Chrome with a number of security features similar to those of Internet Explorer, such as Incognito mode. Like IE 8's InPrivate Browsing, Incognito mode allows users to hide their Web surfing histories, and no cookies are stored beyond the lifetime of a browser window.

"Incognito mode is designed to reduce the amount of data that gets stored on your computer; it's not designed to provide, for instance, anonymous browsing," Fette said. "When you go into Incognito mode you are essentially saying, 'Everything I do in this browser window, please don't record that on my computer once [I] close off that window.'"

Chrome also takes a blacklisting approach using Google's SafeBrowsing API to protect users against known malicious sites.

"I think the biggest advantage that we have is that Chrome is the first browser built from scratch after bad guys started exploiting other browsers," opined Google Engineering Director Linus Upson. "We've had the luxury of looking at the security problems other browser vendors have had, and designing around those from the very beginning."