I was wondering if there were any possible risks in using Google Native Client.
I know it is sandboxed, but the idea still seems risky, and at least leaves another route open for compromising your browser.
According to the diagram on the NACL site, the NACL code runs with the same privileges as the renderer which is a reduced privilege process.
If NACL fails, an attacker can take over the renderer, giving them access to resources in the same renderer process (set of frames that could be in the same domain after some set of document.domain sets).
"The Security Architecture of the Chromium Browser" by Barth, Jackson, Reis, et al. says
It would take a double hull breach to get more privileges than the renderer process.
But the render process has significant authority.
Even though an attacker cannot be able to tamper with other tabs, they can probably tamper with websites in the current tab, including possibly simulating events to load other domains into the owned tab. As long as a renderer can cause page transitions, owning any renderer allows you to craft credential (cookie) carrying requests to any domain. This opens all the same holes as XSRF, but possibly with the ability to keylog if the user interacts with the resulting page.
|show 2 more comments|
Your question is already answered here: Is Google Chrome more secured browser?. You should use search.
Updated: narrowing answer, I want to point to following link: http://code.google.com/contests/nativeclient-security/index-old.html, which would be good starting point for further study. As every large software project, it has its bugs, so, we can judge its safety by looking on Google Chrome or other projects that uses it.