Google to AV vendors: don’t fork Chrome for security, ‘you’ll screw it up'

A Google security engineer has warned all security vendors not fork of Chrome in the hope of making a more secure browser than it already offers.

Comodo’s security-focussed Chromodo browser isn’t the only Chrome fork to have gone under Tavis Ormandy’s knife in recent weeks.

Ormandy, a security engineer at Google and the anti-malware specialist in it bug hunting squad, Project Zero, this week publicly shamed Comodo into fixing a major security no-no in its Chrome-based Chromodo browser.

Before this however Ormandy began probing another Chrome fork from Czech-based security firm Avast called Avastium, which underpins its SafeZone browser.

According to Avast, SafeZone is automatically installed with Avast Premier 2016, Avast Internet Security 2016, and Avast Pro 2016. The browser supports a feature called “Pay mode”, which is meant to protect users against a variety of attacks when they’re visiting online banking or shopping sites.

Ormandy filed the report to Avast on December 18, informing it that Avastium/SafeZone contained a “remote filesystem access vulnerability” that allows an attacker to read any file on the target’s filesystem once the victim has clicked a link under the attacker’s control.

The bug doesn’t allow for remote code execution, but nonetheless poses a potentially serious privacy threat given the browser’s purpose.

According to Ormandy, an Avast user does not have to be using the SafeZone browser to be vulnerable to the attack since the user’s profile is automatically imported from Chrome on startup. Indeed, as he explains, the user doesn’t even have to use Chrome to be exposed.

“If an Avast user using *any* web browser visits an attacker controlled URL, [the attacker] can launch Avastium and take complete control of it; reading files, cookies, passwords, everything. He can even take control of authenticated sessions and read email, interact with online banking, etc,” wrote Ormandy.

Ormandy also criticised Avast for removing WebSafe, a “critical security check” from the Chromium project.

The engineer had some harsh but perhaps wise advice for any security company that promises a more secure browser based on Chromium code.

“Selling antivirus doesn't qualify you to fork chromium, you're going to screw it up,” he said.

Project Zero's policy is not to publicly disclose a bug its researchers have found until 90 days after reports the bug to the affected vendor, or until the vendor issues a patch and notifies users. Ormandy revealed details of the issues today after Avast released its update that addressed the issues he’d reported.


Participate in CSO and Gigamon's survey on Security Priorities today!

Go into the draw for a chance to win an Apple iWatch Sports or the equivalent of $500 Visa Cashcard.

For full terms and conditions click here.

Start survey NOW!


Tags GooglechromeTavis OrmandyAV vendorsvast Internet Security 2016security engineerWebSafeSafeZoneChromodo

Show Comments