The next Google Chrome update will sacrifice performance in the name of security

The Google Chrome security team has shared that it has no qualms about imposing a slight performance penalty on future versions the web browser if this helps make it more secure.

Quoting earlier research that revealed that 70% of all security issues in Chrome concern memory safety bugs, the developers listed the various approaches it could take to improve the security of the browser.

In a joint post, the members of the Chrome security team called application security a “cat and mouse game”, before discussing the available approaches and arguing that any practical solution would come with a slight performance hit.

“In each case, we hope to eliminate a sizable fraction of our exploitable security bugs, but we also expect some performance penalty,” wrote the researchers.

Safer development environment

In broad terms, compile-time checks, runtime checks, and using a memory safe language, are the three approaches that the developers reason could help make Chrome more secure.

In an ideal world, they say they’d have loved to make C++ safer at compile time, if it wasn’t for the design limitations of the language.

“So, we’re mostly left with options 2 and 3 - make C++ safer (but slower!) or start to use a different language. Chrome Security is experimenting with both of these approaches,” explain the developers.

The developers list MiraclePtr as one of the solutions that will play a significant role in future Chrome security initiatives.

Although the solution involves earmarking a portion of memory, which is a precious resource on a mobile device, the solution could help eliminate over half of the use-after-free bugs in the browser, according to the developers.

Rust for safety

At the same time, the team is continuing to look at how it can use a memory safe language, such as Rust, for parts of Chrome in the future.

The search giant has some experience using Rust for this purpose as its Android security team is experimenting using the language in the mobile operating system’s low-level system-code to reign in the number of Android memory-based security vulnerabilities.

“We’ve started to land limited, non-user-facing Rust experiments in the Chromium source code tree, but we’re not yet using it in production versions of Chrome - we remain in an experimental phase,” say the researchers, explaining that the use of Rust brings with it its own set of complexities.

How It works

Search Crack for

Latest IT News

Oct 22
Microsoft Teams users can now further secure their one-to-one calls by enabling end-to-end encryption.
Oct 22
Silence notifications from work or personal apps thanks to Google Workspace.
Oct 22
Update allows Google Meet hosts to turn off video or mics of individual users.
Oct 22
Shopify's new Spotify channel allows artists to sell their merch to fans directly from their profiles on the music streaming service.
Oct 21
Instagram app might soon include the option to open Facebook directly from within its app.
Oct 21
Intel says new machine learning-powered tool has already helped improve several open source and proprietary software.
Oct 21
Update to Google Workspace lets you block off calendar time to focus.

Latest cracks