This is one of those situations where the author's simplification makes his assessment dangerously misleading. In the case of DEP+ASLR, there's rarely any value

This is one of those situations where the author's simplification makes his assessment dangerously misleading. In the case of DEP+ASLR, there's rarely any value in doing it partway. If every executable image in your process does not have DEP+ASLR, then the protection is often worthless because either the attacker will be able to generate executable pages or will have enough predictable surface for a ROP chain. However, to make that assessment against an application you also have to verify what the files are and when/where they're actually loaded. And of course, you have to look at how the rest of the application runs to verify it doesn't undermine the protection provided by ASLR+DEP (e.g. Java historically allocated all memory RWX, making DEP pointless). Since I know Chrome well I can use it as an example assessment. The first thing he mentions is xinput1_3.dll, and he correctly notes that this is used only when a gamepad is connected. What he doesn't mention is it's used only on Windows XP, which has no ASLR support. Since DEP is essentially worthless without ASLR, this file doesn't really have any negative security impact. Of course, it would be best if this DLL simply had ASLR+DEP enabled, but unfortunately it's part of Microsoft's DX library and MS doesn't see the point in changing it (for the reasons I've described). As for the oddly named installer files, they look like differential updaters, which are temporary files created during an update. They don't handle any malicious data because all of the data is embedded in the executable file and the whole binary's signature is verified before it's run. I'm not sure if there's something preventing ASLR+DEP on these files. I'd have to check with the Omaha project http://code.google.com/p/omaha/ http://code.google.com/p/omaha/ to verify, since they're a separate project and I just don't know it as well as Chrome.