Given Windows 10’s appalling recent update record, that’s not reassuring for either browser or platform. Moreover, Forshaw explains a new Windows 10 update recently broke through Chrome’s security with just a single line of misplaced code. In a fascinating post titled ‘You Won't Believe what this One Line Change Did to the Chrome Sandbox’, Google’s Project Zero researcher James Forshaw revealed that Chrome is entirely reliant on the code of Windows 10 to stay secure. However, I wouldn't mention them flippantly, without having the knowledge to back it up." I have put Forshaw's points to Firefox for a response. The ball is in your court, Microsoft.Įxplaining his decision not to focus more centrally on Firefox in his initial report, Forshaw explains: "I wasn't trying to throw them under a bus, it's not their fault that Windows is broken. It’s important for every user to keep their operating system and application up to date in order to keep their computer environment as safe as possible." Of course, the challenge for any Windows 10 user, right now, is tracking which updates cause more problems than they fix. Chromium sandboxing is considered state-of-the-art, however, similar to any sandboxing, it relies on the lower levels of stacks to work properly. "Kernel-level bugs can impact every application running on the operating system. The browser security sandboxing is dependent on the operating system’s features and security," he explained, confirming that Opera was affected.
"Opera is a Chromium-powered browser and uses its sandboxing mechanisms. I have followed this up with Firefox, Opera, Brave and Microsoft and will update when I have more information.Ġ4/25 Update: More information about this issue has today been provided by Opera Product Security Manager Cezary Cerekwicki.
The result is Forshaw's research exposes a vulnerability for the sandbox of all major browsers to updates in Windows 10. Edit: James Forshaw has clarified that Firefox is impacted the same way because it uses the Chromium sandbox which Mozilla confirms.
0 kommentar(er)
