Security flaws hit Google’s Chrome

Security researchers have been quick to find flaws in Chrome, Google's shiny foray into the browser market.

Google launched the browser this week, to the surprise and delight of many, but security researcher Affiv Raff posted yesterday on his site a proof of concept for an exploit in the browser, which takes advantage of code borrowed from an old version of Apple's Safari. The flaw leaves the Google browser open to carpet bombing attacks, the researcher said.

According to Raff, Chrome is based on WebKit 525.13, which is essentially Safari 3.1, and features the same flaw that Apple has since patched in its browser. That flaw, paired with a Java bug, could be used to execute code in Chrome.

Raff wrote: "I really wonder why Google have taken several features from other browsers and mixed them all together. Security wise, it's very problematic. They'll have to track all security vulnerabilities in those features, and fix them in Chrome too. This will probably be only after those vulnerabilities were fixed by the other vendors or were publicly reported. It will put Chrome users at risk for a long time."

Raff added: "Chrome seems to be a very nice and slick browser, but it is far from being secured as it is advertised by Google. It borrows several insecure features from other browsers, and it has its own security design flaws."

Another flaw was discovered by researcher Rishi Narang, which he said can lead to the browser crashing without any user interaction.

He wrote on his site: "When a user is made to visit a malicious link, which has an undefined handler followed by a 'special' character, the chrome crashes with a Google Chrome message window Whoa! Google Chrome has crashed. Restart now?'."

Another criticism of the Chrome browser has been the user licence, section 11 of the agreement which pops up when users download the software.

At launch, it creepily read: "By submitting, posting or displaying the content you give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services."

After a bit of controversy, Google has now changed it to: "You retain copyright and any other rights that you already hold in Content that you submit, post or display on or through the Services."