Chrome Virtualization

Craig321 · 20 Sep 2008 at 20:49

Am I right in saying Chrome effectively uses the same protected mode as Internet Explorer uses when UAC is on?

Thanks,
Craig.

Dolph · 20 Sep 2008 at 23:37

Craig321 said:
Am I right in saying Chrome effectively uses the same protected mode as Internet Explorer uses when UAC is on?

Thanks,
Craig.

Pretty much, yes, it runs as a series of low integrity processes which will dramatically limit the access levels it has to other parts of the system exactly the same as IE.

Craig321 · 21 Sep 2008 at 00:53

Cool, thanks for the reply.

tolien · 21 Sep 2008 at 10:33

Though it's debatable how effective it's been, given there's already exploits for Chrome...

Sarduk · 21 Sep 2008 at 10:55

tolien said:
Though it's debatable how effective it's been, given there's already exploits for Chrome...

What reports have you heard of using exploits to penetrate past the sandbox?

tolien · 21 Sep 2008 at 11:17

JimpsEd said:
What reports have you heard of using exploits to penetrate past the sandbox?

http://uk.youtube.com/watch?v=QJhcGRJEQ2w, for starters - it's the WebKit carpetbomb bug (that's been fixed in WebKit for ages).

On the other hand the worst it can do, unless you've disabled UAC or blindly hit Continue/Allow, is mess up your own stuff - but that's the worst that can happen with "insecure" Firefox/Opera/IE without protected mode.

Craig321 · 21 Sep 2008 at 13:25

tolien said:
http://uk.youtube.com/watch?v=QJhcGRJEQ2w, for starters - it's the WebKit carpetbomb bug (that's been fixed in WebKit for ages).

On the other hand the worst it can do, unless you've disabled UAC or blindly hit Continue/Allow, is mess up your own stuff - but that's the worst that can happen with "insecure" Firefox/Opera/IE without protected mode.

Not sure if I was too late, or I got an update just after the exploit was released but the download exploit never worked for me, only the crash one worked.