2

Chrome Frame is an add in that integrates with IE and Firefox. Firefox has a similar component, and I hear that the .NET runtime finds its way into all the other browsers.

Additional integration points include:

This integration greatly widens my surface area of attack. I would like to still run multiple browers, but keep them completely isolated from each other.

How can I "unmerge" (for lack of a better word) all the browsers that I've installed? I'm not limited to just Chrome here (though I'm using this as an example).

What other integration points can browsers use? Namely Chrome, Firefox, Safari, IE, Opera?

1

Now that you've edited your question, you are basically asking about two different kinds of situations:

  • Add-ins. Chrome Frame is one of these. The best way to reduce the attack surface is just to not install these add-ins that worry you.

  • Browser bugs. The protocol handlers you mention (firefoxurl and cf) are functionality that is built into the browser. The specific vulnerabilities you point to are bugs in the browser, which have since been fixed. There's not a lot you can do to protect yourself from browser bugs; the onus is really on the browser developers. The best you can do is make sure your browser is fully updated, and use a browser with a good reputation for security (Chrome has an especially good reputation for security).

  • Thanks D.W.- Can protocol handlers be referenced or accessed in another browser? I was lumping this in the class of "merged functionality" and not a clean separation as the UI indicates (two tabs, two different products they are "independent" right). My intent is to uncover other technologies that allow a browser instance to refer or link to some other manufacturer's browser. – goodguys_activate Mar 7 '12 at 20:58
  • @makerofthings7, The answer is "No". Firefox protocol handlers do not create the kind of risk you're talking about. Perhaps we need to start with some background about what a "protocol handler" is. The best way to explain is by example. A Firefox protocol handler for (say) the ftp: protocol is a piece of Firefox code that is invoked when Firefox loads URLs with the ftp: protocol (e.g., ftp://example.com/foo.zip). If that code is buggy, it might make Firefox vulnerable to attacks when you are using Firefox -- but a bug in this Firefox code won't affect (say) IE or Chrome. – D.W. Mar 8 '12 at 0:04
  • 1
    @D.W. there was in fact a "cross-browser" bug, not too long ago - an IE protocol handler to activate Firefox caused a vulnerability in browser activation. I wrote "cross-browser", even though it's not really, simply because it was ambiguous where the bug lies: MS blamed FF for not sanitizing input, FF blamed IE handlers for sending malformed data in what should be a trusted path. (If my memory serves, though I may have the details wrong). Thus one browser's handler can have an effect on another browser. – AviD Mar 9 '12 at 14:18
1

In the case of Chrome Frame, you can force the enablement (or disablement) of it through an HTTP header (which could be sent by a [transparent] proxy) or via a locally or globally scoped Windows registry entry.

1

You can arrange some separation between Google Chrome Frame and Google Chrome by creating separate profiles to use with each. If you are acting as group policy administrator for machines that use Google Chrome Frame, you can set different directories as the User Data Directory and the Google Chrome Frame User Data Directory.

Regarding either of these cases, I note where Google says, "The ability to add multiple users to Chrome.... isn't intended to secure your data against other people using your computer." This warning reminds me that, although separate profiles probably make it harder for an attack via Google Chrome Frame to affect Google Chrome or vice versa, they don't provide any strong guarantees.

To separate the risks more, you can get some real benefit with limited effort by making a new Windows user account where you can conduct your Google Chrome browsing sessions. With Fast User Switching it can be reasonably convenient to flip between them.

1

How can I "unmerge" (for lack of a better word) all the browsers that I've installed? In other words, I don't want Chrome vulnerabilities to exist while I browse using IE.

Vulnerabilities in Google Chrome are not directly affecting Microsoft's Internet Explorer.

  • 1
    That's not true in the case of Chrome Frame. – atdre Mar 5 '12 at 20:40
  • @atdre, Does Chrome automatically install Chrome Frame? – Hendrik Brummermann Mar 5 '12 at 21:15
  • Chrome Frame is installed separately or instead of Chrome or Chromium, but is only available for Windows. – atdre Mar 6 '12 at 8:24
  • 2
    @atdre - The author's question is silly. They are asking how do I avoid a vulernability within Chrome but still use the Chrome Frame within IE. If you don't want Chrome vulerabiltiies to effect IE stop using Chrome Frame. – Ramhound Mar 6 '12 at 12:54
  • @Ramhound - I now see that Chrome Frame is a second install... I thought it came with Chrome. – goodguys_activate Mar 7 '12 at 5:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.