4 ms·

What's the state of browser security these days? Does Chrome still have a lead over Safari and Firefox?

jimrandomh 4y ago
Yes, it does, at least if you go by how much money the sketchy vulnerability brokers are offering to pay. On https://zerodium.com/program.html https://zerodium.com/program.html a Chrome RCE+LPE is "Up to $500k", while the other browsers are all less.
- leoc 4y ago
  I guess that that partly reflects its greater market share though.
  - guilhas 4y ago
    And that attackers also focus more on the higher market share Chrome is also not immune, very recently had a serious flaw "actively exploited" https://www.bleepingcomputer.com/news/security/google-chrome-emergency-update-fixes-zero-day-used-in-attacks/ https://www.bleepingcomputer.com/news/security/google-chrome...
  - mlinksva 4y ago
    I wonder how those $ amounts are arrived at, I don't see in FAQ. Maybe a third party study of potential factors and prices (quick search I'm not finding anything promising)? Surely market share/adoption is very significant, but something else must explain e.g., 2.5x more for Apache RCE than Nginx RCE?
    - Hackbraten 4y ago
      There are several factors that may affect per-app supply and demand. - How expensive is it to discover a new vulnerability in a given app? (This may depend on code base maturity but also on choice of programming language, its inherent memory safety, and supply chain.) - What privileges does a typical installation of the app grant once RCE is achieved? - How hard is it to write a working exploit for a newly-discovered vulnerability, taking into account the security architecture that protects the app? - Given a zero-day exploit, how many times will you have the opportunity to use it? How quickly will other parties discover it, is the vendor willing to provide patches, how long it is going to take, how much do the updates cost, and how difficult is it to upgrade the software in the field? - Apps and computers tend to come in packs, and attackers love to move laterally. What opportunities would an attacker gain from lateral movement after gaining persistence in a given system? - Market share and adoption may be skewed, as attackers may be interested in specific targets such as journalists or politicians, who may form a specific demographic with particular adoption rates, which can differ from those of the general population.
- weaksauce 4y ago
  https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share if you believe those numbers... 64% vs 3% market share. of course something that impacts 64% of the internet will be more valuable.
  - rockdoe 4y ago
    Would the majority of the current "desktop" software actually being outdated Chromium/Electron/CEF stuff factor into this too?
    - weaksauce 4y ago
      I really doubt it. https://www.w3schools.com/browsers/default.asp https://www.w3schools.com/browsers/default.asp that's another sampling of actual web visits. though it skews more tech oriented of course so that's going to be away from safari/ie and more toward firefox and chrome.
      - rockdoe 4y ago
        I mean in the rewards. A lot of those "desktop apps" have embedded "WebViews", if you know what I mean, which would effectively be running outdated Chrome versions, which would be easier to exploit than the real thing.
- black_puppydog 4y ago
  Ahhh, the breath of fresh air coming from a truly free market doing what markets do best: processing information in the face of uncertainty to the benefit of all! Don't you feel the soft touch of the invisible hand, gently working to raise the tide of security for all? /s
fulafel 4y ago
A constant stream of newly discovered (but long existing) remote code execution vulnerabilities has been the norm for years and no quick change in sight. Depending on who you ask, catastrophic, or manageable.
trasz 4y ago
Does Chrome still require a suid root helper?
- rs_rs_rs_rs_rs 4y ago
  It doesn't and even if it did it would still be a better browser than Firefox security-wise. Google poured a lot of money into it with really good results.
  - rockdoe 4y ago
    >It doesn't It does require one if your system doesn't support user namespaces. Some distros used to disable it, but they're getting rare these days.
    - staticassertion 4y ago
      Really? That's surprising, I thought they already dropped the setuid requirement when they implemented the bpf sandbox.
      - rockdoe 4y ago
        You can probably still have a meaningful bpf sandbox even without the setuid root helper (or user namespaces), but I'm not sure Chrome supports running that way (because it doesn't make much sense from a security tradeoff point of view). As ugly as it is, the odds of a bug in the setuid helper are probably smaller than the odds of a bug in the attack surface its mitigations remove. But the setuid helper and user namespaces are used for other mitigations that can't be done through bpf. The guys who wrote the bpf sandbox have some nice articles about the distinction which you can probably Google.
    - account42 4y ago
      OTOH user namespaces also greatly increase the attack surface. Earlier this year they gave us CVE-2022-0185.
ehsankia 4y ago
Well looking at this specific feature, I believe chrome got site isolation mid-2018 and enabled it by default mid-2019. From what I can tell Firefox got it mid-2021. I don't know much about the specifics of the implementations, but that seems like a significant difference for such a crucial security feature, especially post meltdown/spectre.
- evmar 4y ago
  The kind of isolation in the post, where the web content doesn't have access to system resources, was part of the original Chrome release. (You mentioned site isolation, which is a different feature, but the dates you have look right for that.)
  - rockdoe 4y ago
    This is not correct - like the person you're responding to, you're mixing up security features. For one, Chrome predates Windows 8, where this mitigation was introduced, so it can't have supported it before it existed. I think you're confusing the general "sandbox that restricts access to the kernel" with the specific mitigation here. Firefox also had the generic kernel mitigations long ago: https://news.ycombinator.com/item?id=31362935 https://news.ycombinator.com/item?id=31362935 But it's true Chrome had them first. The same thread points out that Firefox reuses Chrome's sandbox, so like in the first sentence, there are causality constraints that would make it hard for Firefox to support it before Chrome did :-)
    - evmar 4y ago
      Thanks for explaining, sorry for the mistake!
staticassertion 4y ago
Practically speaking there's probably not a ton of difference. ITW exploits are pretty uncommon for both, and they're typically somewhat targeted. I haven't paid attention in years for this reason, but I'd guess that Chrome is ahead - mitigation techniques like site isolation are quickly improving in it and were adopted earlier as well. In general my recollection is that Chrome splits up more of its components. It sounds like, based on this post, the gpu process is now separated and there's sandboxing efforts going into that, but I'm pretty sure Chrome has had that for years now.
- rockdoe 4y ago
  Firefox has also had this for over 5 years: https://www.mozilla.org/en-US/firefox/53.0a2/releasenotes/ https://www.mozilla.org/en-US/firefox/53.0a2/releasenotes/ The current mitigations seem to be doubling-down on getting rid of C++ memory safety errors (still the main source of security holes), with Mozilla pulling the Rust and WebAssembly card. So there's some divergence here, rather than parallel paths with one ahead.
codethief 4y ago
Related discussion: https://news.ycombinator.com/item?id=31363974 https://news.ycombinator.com/item?id=31363974

Yes, it does, at least if you go by how much money the sketchy vulnerability brokers are offering to pay. On https://zerodium.com/program.html https://zerodium.com/program.html a Chrome RCE+LPE is "Up to $500k", while the other browsers are all less.

leoc 4y ago
I guess that that partly reflects its greater market share though.
- guilhas 4y ago
  And that attackers also focus more on the higher market share Chrome is also not immune, very recently had a serious flaw "actively exploited" https://www.bleepingcomputer.com/news/security/google-chrome-emergency-update-fixes-zero-day-used-in-attacks/ https://www.bleepingcomputer.com/news/security/google-chrome...
- mlinksva 4y ago
  I wonder how those $ amounts are arrived at, I don't see in FAQ. Maybe a third party study of potential factors and prices (quick search I'm not finding anything promising)? Surely market share/adoption is very significant, but something else must explain e.g., 2.5x more for Apache RCE than Nginx RCE?
  - Hackbraten 4y ago
    There are several factors that may affect per-app supply and demand. - How expensive is it to discover a new vulnerability in a given app? (This may depend on code base maturity but also on choice of programming language, its inherent memory safety, and supply chain.) - What privileges does a typical installation of the app grant once RCE is achieved? - How hard is it to write a working exploit for a newly-discovered vulnerability, taking into account the security architecture that protects the app? - Given a zero-day exploit, how many times will you have the opportunity to use it? How quickly will other parties discover it, is the vendor willing to provide patches, how long it is going to take, how much do the updates cost, and how difficult is it to upgrade the software in the field? - Apps and computers tend to come in packs, and attackers love to move laterally. What opportunities would an attacker gain from lateral movement after gaining persistence in a given system? - Market share and adoption may be skewed, as attackers may be interested in specific targets such as journalists or politicians, who may form a specific demographic with particular adoption rates, which can differ from those of the general population.
weaksauce 4y ago
https://gs.statcounter.com/browser-market-share https://gs.statcounter.com/browser-market-share if you believe those numbers... 64% vs 3% market share. of course something that impacts 64% of the internet will be more valuable.
- rockdoe 4y ago
  Would the majority of the current "desktop" software actually being outdated Chromium/Electron/CEF stuff factor into this too?
  - weaksauce 4y ago
    I really doubt it. https://www.w3schools.com/browsers/default.asp https://www.w3schools.com/browsers/default.asp that's another sampling of actual web visits. though it skews more tech oriented of course so that's going to be away from safari/ie and more toward firefox and chrome.
    - rockdoe 4y ago
      I mean in the rewards. A lot of those "desktop apps" have embedded "WebViews", if you know what I mean, which would effectively be running outdated Chrome versions, which would be easier to exploit than the real thing.
black_puppydog 4y ago
Ahhh, the breath of fresh air coming from a truly free market doing what markets do best: processing information in the face of uncertainty to the benefit of all! Don't you feel the soft touch of the invisible hand, gently working to raise the tide of security for all? /s

fulafel 4y ago

A constant stream of newly discovered (but long existing) remote code execution vulnerabilities has been the norm for years and no quick change in sight. Depending on who you ask, catastrophic, or manageable.

trasz 4y ago

Does Chrome still require a suid root helper?

rs_rs_rs_rs_rs 4y ago
It doesn't and even if it did it would still be a better browser than Firefox security-wise. Google poured a lot of money into it with really good results.
- rockdoe 4y ago
  >It doesn't It does require one if your system doesn't support user namespaces. Some distros used to disable it, but they're getting rare these days.
  - staticassertion 4y ago
    Really? That's surprising, I thought they already dropped the setuid requirement when they implemented the bpf sandbox.
    - rockdoe 4y ago
      You can probably still have a meaningful bpf sandbox even without the setuid root helper (or user namespaces), but I'm not sure Chrome supports running that way (because it doesn't make much sense from a security tradeoff point of view). As ugly as it is, the odds of a bug in the setuid helper are probably smaller than the odds of a bug in the attack surface its mitigations remove. But the setuid helper and user namespaces are used for other mitigations that can't be done through bpf. The guys who wrote the bpf sandbox have some nice articles about the distinction which you can probably Google.
  - account42 4y ago
    OTOH user namespaces also greatly increase the attack surface. Earlier this year they gave us CVE-2022-0185.

ehsankia 4y ago

Well looking at this specific feature, I believe chrome got site isolation mid-2018 and enabled it by default mid-2019. From what I can tell Firefox got it mid-2021. I don't know much about the specifics of the implementations, but that seems like a significant difference for such a crucial security feature, especially post meltdown/spectre.

evmar 4y ago
The kind of isolation in the post, where the web content doesn't have access to system resources, was part of the original Chrome release. (You mentioned site isolation, which is a different feature, but the dates you have look right for that.)
- rockdoe 4y ago
  This is not correct - like the person you're responding to, you're mixing up security features. For one, Chrome predates Windows 8, where this mitigation was introduced, so it can't have supported it before it existed. I think you're confusing the general "sandbox that restricts access to the kernel" with the specific mitigation here. Firefox also had the generic kernel mitigations long ago: https://news.ycombinator.com/item?id=31362935 https://news.ycombinator.com/item?id=31362935 But it's true Chrome had them first. The same thread points out that Firefox reuses Chrome's sandbox, so like in the first sentence, there are causality constraints that would make it hard for Firefox to support it before Chrome did :-)
  - evmar 4y ago
    Thanks for explaining, sorry for the mistake!

staticassertion 4y ago

Practically speaking there's probably not a ton of difference. ITW exploits are pretty uncommon for both, and they're typically somewhat targeted. I haven't paid attention in years for this reason, but I'd guess that Chrome is ahead - mitigation techniques like site isolation are quickly improving in it and were adopted earlier as well. In general my recollection is that Chrome splits up more of its components. It sounds like, based on this post, the gpu process is now separated and there's sandboxing efforts going into that, but I'm pretty sure Chrome has had that for years now.

rockdoe 4y ago
Firefox has also had this for over 5 years: https://www.mozilla.org/en-US/firefox/53.0a2/releasenotes/ https://www.mozilla.org/en-US/firefox/53.0a2/releasenotes/ The current mitigations seem to be doubling-down on getting rid of C++ memory safety errors (still the main source of security holes), with Mozilla pulling the Rust and WebAssembly card. So there's some divergence here, rather than parallel paths with one ahead.

codethief 4y ago

Related discussion: https://news.ycombinator.com/item?id=31363974 https://news.ycombinator.com/item?id=31363974