Google Chrome vows to carpet bomb meddling Windows antivirus tools

[HarborFront]

Browser will block third-party software from mucking around with pages next year

By mid-2018 Google Chrome will no longer allow outside applications – cough, cough, antivirus packages – to run code within the browser on Windows.

This is according to a post today on the Chromium blog that laid out the July release of Chrome 68 for Windows as the target for new rules that will block all third-party apps from injecting scripts into browser sessions.

The idea, explained the Chocolate Factory, is to cut down on stability issues that arise when Chrome lets other apps execute code that can be buggy or incompatible with other software.

"Roughly two-thirds of Windows Chrome users have other applications on their machines that interact with Chrome, such as accessibility or antivirus software," said Chrome stability team member Chris Hamilton.

"In the past, this software needed to inject code in Chrome in order to function properly; unfortunately, users with software that injects code into Windows Chrome are 15 per cent more likely to experience crashes."

In particular, the target here seems to be poorly coded AV tools can not only crash the browser or cause slowdowns, but also introduce security vulnerabilities of their own for hackers to exploit.

Rather than accept injected code, Chrome will require applications to use either Native Messaging API calls or Chrome extensions to add functionality to the browser. Google believes both methods can be used to retain features without having to risk browser crashes.

For now, the policy will likely only be of concern to developers. Users won't notice the development until April 2018, when Chrome 66 will begin showing notifications after Chrome crashes due to injected code. These alerts will finger third-party programs for the cause of the breakdown.

With Chrome 68, the browser will block third-party code in all cases except when the blocking itself would cause a crash. In that case, Chrome will reload, allow the code to run, and then give the user a warning that the third-party software will need to be removed for Chrome to run properly. The warning will be removed and nearly all code injection will be disabled in January of 2019.

"While most software that injects code into Chrome will be affected by these changes, there are some exceptions," said Hamilton.

"Microsoft-signed code, accessibility software, and IME software will not be affected."

Google is advising developers to get out ahead of the changes by shifting to extensions or Native Messaging and testing their software for compatibility with Chrome Beta browser builds. Essentially, get rewriting your code, programmers

Google Chrome vows to carpet bomb meddling Windows antivirus tools

 

[Deleted member 65228]

Actually I don't think any popular AV vendors who do inject code into Google Chrome are worried about the latest announcement. Has Google learnt absolutely nothing? If an third-party AV wants to inject into Google Chrome then it will succeed to do so

Google can do whatever they want. It won't stop an AV vendor from injecting before the main thread of their process is executed using reflective DLL loading (hide from module scanning) and/or using additional techniques to conceal evidence of any byte-patching in the process' memory.

Anyway software with more privileges like a popular AV using kernel-mode components can just obtain a pointer structure to EPROCESS structure of the Google Chrome processes and then attach to it using that to be within the context of that process. Or rely on injection without a DLL (e.g. code-cave)

So the goal is blocking all third-party injection is unrealistic and misleading imo

The mechanisms they will introduce as alternates are good and a nice step towards reducing how many will inject into their software though

 

[ForgottenSeer 58943]

I cannot stress how many applications this will impact.

Trusteer injects. Stickypassword injects. Many AV's inject. Quite a number of corporate tools inject. All of them will basically have to be rewritten.

Good time to start the conversion from Stickypassword to Bit Warden, since Bit Warden is a native extension API. Google is right though, the majority of Chrome crashes and failures are these injecting applications.

 

[DeepWeb]

It's about time. Microsoft has been telling AVs to stop this nonsense. That Mozilla dev had an entire rant about this that went viral. Now Google has had it with them. I for one will enjoy seeing what apps will break due to this. It will expose all of these troublemakers.

Edit: Ugh I hope Keyscrambler is unaffected by this.

 

[Tsiehshi]

Google is advising developers to get out ahead of the changes by shifting to extensions or Native Messaging and testing their software for compatibility with Chrome Beta browser builds. Essentially, get rewriting your code, programmers

It's a step in the right direction, but extensions can be even more deceptive in that the vast majority of users assume an extension must be safe as soon as it makes it into Chrome Webstore. All these efforts will come to nothing if Google don't improve their extension policy.

 

[Deleted member 65228]

I sincerely hope they make a bug bounty system for the release so I can become rich overnight

If they do it will be a good oppertunity for me to submit standard rights bypasses and then quit my job while I take a holiday down to the south, bit chilly here in the mountains

Thing is no matter what they want they aren't going to achieve it. AV engineers have been working on self-protection since I was born and no matter how much money Google has they aren't going to overtake SP mechanisms for anti-RCE than the billionaire vendors which already exist and have more privileges on the system than Chrome. People still exploit them

 

[boredog]

Why stick with Chrome anyway?

 

[Deleted member 65228]

Why stick with Chrome anyway?

A lot of people grew up with it and it can be tricky for them to let go of it. I'm still struggling not to use it. I was supposed to have switched to Firefox but I keep finding myself back on Google Chrome, and I don't want to uninstall it. I assume others might be in the same boat

Some people also find it to be faster and more responsive than others browsers. But I admit despite me using it that I believe Firefox are a much better vendor to go with because they care more about privacy. I'd use MS Edge but even with a 6 core 3.2ghz AMD CPU and 16GB DDR4 RAM it is too sluggish for my liking, compared to Chrome/FF which is more or less lightning fast for me

Even on my phone when I open the browser = Chrome. It is what I am used to and don't want to install a different browser for Android

 

[boredog]

The first browser I used instead of IE was Netscape. Guess I have tried them all over the years. Currently I use Edge on my PC and Yandex on my Android.