The author is not saying Google Chrome is a security risk -- he's saying that malware has goals and behavior similar to Google's software updater. > Here are j

The author is not saying Google Chrome is a security risk -- he's saying that malware has goals and behavior similar to Google's software updater. > Here are just some of the reasons Google’s software update system can serve as a model APT. (1) There is a bootstrapping program, GoogleSoftwareUpdateAgent, buried deeply in a user’s home directory. Few people know it is there, even fewer probably know when it becomes active. It neither requests permission to modify your system nor notifies you when it does. (2) Detailed analysis of this bootstrapping program cannot reveal what it may do because actual actions (via programs & scripts in this case) are only received from the Internet at runtime. (3) A critical executable (one you trust with your passwords for many important network services) will be modified. The paper then goes on to argue that this is a useful test case for people trying to detect when malware has modified their system, and what it has modified. The paper does not discuss the security strengths or flaws of Chromium itself --- that discussion is completely tangential to the paper.