Update Chromium-browsers getting Intel CET support

silversurfer

Level 75
Verified
Trusted
Content Creator
Malware Hunter
Aug 17, 2014
6,418
Chromium-based browsers such as Microsoft Edge and Google Chrome will soon support the Intel CET security feature to prevent a wide range of vulnerabilities.

Intel's Control-flow Enforcement Technology (CET) is a hardware security feature initially introduced in 2016 and added to Intel's 11th generation CPUs in 2020.

The CET feature is designed to protect programs from Return Oriented Programming (ROP) and Jump Oriented Programming (JOP) attacks that modify an application's normal flow so that an attacker's malicious code is executed instead.

"JOP or ROP attacks can be particularly hard to detect or prevent because the attacker uses existing code running from executable memory in a creative way to change program behavior," explains Microsoft's Baiju V Patel.

These vulnerabilities include attacks that bypass a browser's sandbox or perform remote code execution while visiting web sites.

Intel CET is a hardware-based solution that blocks these attempts by triggering exceptions when the natural flow is modified.

Chromium-browsers getting Intel CET support

Windows 10 supports Intel CET through an implementation called Hardware-enforced Stack Protection.

For Windows applications to support this feature, they must first be compiled with the /CETCOMPAT linker flag in Visual Studio. When compiled with this flag, a program will be marked as CET Shadow Stack-compatible and opted into the security protection.

Microsoft Edge vulnerability research lead Johnathan Norman tweeted that Microsoft Edge 90 would support the Intel CET feature in non-renderer processes.
Edge 90 (Canary) now supports Intel's CET non-renderer processes. If you have a fancy new processor give it a try.
— Johnathan Norman (@spoofyroot) February 11, 2021
This security feature does not appear to be specific to Microsoft Edge but is coming to all Chromium browsers, including Google Chrome, Brave, and Opera.
 

Gandalf_The_Grey

Level 50
Verified
Trusted
Content Creator
Apr 24, 2016
3,976
Windows 10 users running Intel 11th generation CPUs or AMD Zen 3 Ryzen CPUs, which also support CET, can use the Windows Task Manager to check if a process utilizes the hardware security feature.

To do this, open Task Manager, go into the Details tab, right-click on a column header, and then select 'Select Colums.'
When the 'Select columns' dialog opens, scroll to the bottom and put a checkmark in 'Hardware-enforced Stack Protection.' Once enabled, this column will show you which processes support the Intel CET security feature.
BleepingComputer does not have any devices running 11th generation Intel CPUs to test this feature.

Google Chrome and Microsoft Edge 90 are expected to be released on April 13, 2021.
I have the same problem, only for new hardware...
 

Andy Ful

Level 72
Verified
Trusted
Content Creator
Dec 23, 2014
6,144
Yes. CET is also available on AMD ZEN 3 processors. :)

1613397911630.png
 

HarborFront

Level 59
Verified
Content Creator
Oct 9, 2016
4,834
I have the same problem, only for new hardware...
Hmm, might ditch Firefox and check out Edge again. Nothing interesting on the Firefox side anymore. :confused:
According to the below FF is looking into adding support for Intel CET. Hopefully, it'll be release in time with those Chromium-based browsers

 
Last edited:
F

ForgottenSeer 85179

According to the below FF is looking into adding support for Intel CET. Hopefully, it'll be release in time with those Chromium-based browsers

Like they're working on sandbox for years?

Of course they need publishing such a news but without people at security team they can't archive that.
 
Top