Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Chrome Frame is an add in that integrates with IE and Firefox. Firefox has a similar component, and I hear that the .NET runtime finds its way into all the other browsers.

Additional integration points include:

This integration greatly widens my surface area of attack. I would like to still run multiple browers, but keep them completely isolated from each other.

How can I "unmerge" (for lack of a better word) all the browsers that I've installed? I'm not limited to just Chrome here (though I'm using this as an example).

What other integration points can browsers use? Namely Chrome, Firefox, Safari, IE, Opera?

share|improve this question

4 Answers

up vote 1 down vote accepted

Now that you've edited your question, you are basically asking about two different kinds of situations:

  • Add-ins. Chrome Frame is one of these. The best way to reduce the attack surface is just to not install these add-ins that worry you.

  • Browser bugs. The protocol handlers you mention (firefoxurl and cf) are functionality that is built into the browser. The specific vulnerabilities you point to are bugs in the browser, which have since been fixed. There's not a lot you can do to protect yourself from browser bugs; the onus is really on the browser developers. The best you can do is make sure your browser is fully updated, and use a browser with a good reputation for security (Chrome has an especially good reputation for security).

share|improve this answer
Thanks D.W.- Can protocol handlers be referenced or accessed in another browser? I was lumping this in the class of "merged functionality" and not a clean separation as the UI indicates (two tabs, two different products they are "independent" right). My intent is to uncover other technologies that allow a browser instance to refer or link to some other manufacturer's browser. – makerofthings7 Mar 7 '12 at 20:58
@makerofthings7, The answer is "No". Firefox protocol handlers do not create the kind of risk you're talking about. Perhaps we need to start with some background about what a "protocol handler" is. The best way to explain is by example. A Firefox protocol handler for (say) the ftp: protocol is a piece of Firefox code that is invoked when Firefox loads URLs with the ftp: protocol (e.g., ftp://example.com/foo.zip). If that code is buggy, it might make Firefox vulnerable to attacks when you are using Firefox -- but a bug in this Firefox code won't affect (say) IE or Chrome. – D.W. Mar 8 '12 at 0:04
1  
@D.W. there was in fact a "cross-browser" bug, not too long ago - an IE protocol handler to activate Firefox caused a vulnerability in browser activation. I wrote "cross-browser", even though it's not really, simply because it was ambiguous where the bug lies: MS blamed FF for not sanitizing input, FF blamed IE handlers for sending malformed data in what should be a trusted path. (If my memory serves, though I may have the details wrong). Thus one browser's handler can have an effect on another browser. – AviD♦ Mar 9 '12 at 14:18
up vote 1 down vote

How can I "unmerge" (for lack of a better word) all the browsers that I've installed? In other words, I don't want Chrome vulnerabilites to exist while I browse using IE.

A vulerability in Chrome is not going to effect Internet Explorer.

share|improve this answer
1  
That's not true in the case of Chrome Frame. – atdre Mar 5 '12 at 20:40
@atdre, Does Chrome automatically install Chrome Frame? – Hendrik Brummermann♦ Mar 5 '12 at 21:15
Chrome Frame is installed separately or instead of Chrome or Chromium, but is only available for Windows. – atdre Mar 6 '12 at 8:24
2  
@atdre - The author's question is silly. They are asking how do I avoid a vulernability within Chrome but still use the Chrome Frame within IE. If you don't want Chrome vulerabiltiies to effect IE stop using Chrome Frame. – Ramhound Mar 6 '12 at 12:54
@Ramhound - I now see that Chrome Frame is a second install... I thought it came with Chrome. – makerofthings7 Mar 7 '12 at 5:18
show 4 more comments
up vote 1 down vote

In the case of Chrome Frame, you can force the enablement (or disablement) of it through an HTTP header (which could be sent by a [transparent] proxy) or via a locally or globally scoped Windows registry entry.

share|improve this answer
Do you know what the HTTP Header is? Or Reg key? – makerofthings7 Mar 5 '12 at 22:05
2  
Not off the top of my head, no. But I think I remember this Wikipedia entry being of use in those areas -- en.wikipedia.org/wiki/Chrome_Frame – atdre Mar 6 '12 at 8:24
up vote 1 down vote

You can arrange some separation between Google Chrome Frame and Google Chrome by creating separate profiles to use with each. If you are acting as group policy administrator for machines that use Google Chrome Frame, you can set different directories as the User Data Directory and the Google Chrome Frame User Data Directory.

Regarding either of these cases, I note where Google says, "The ability to add multiple users to Chrome.... isn't intended to secure your data against other people using your computer." This warning reminds me that, although separate profiles probably make it harder for an attack via Google Chrome Frame to affect Google Chrome or vice versa, they don't provide any strong guarantees.

To separate the risks more, you can get some real benefit with limited effort by making a new Windows user account where you can conduct your Google Chrome browsing sessions. With Fast User Switching it can be reasonably convenient to flip between them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.