Google has issued a new warning to all Chrome’s 3.2 billion users worldwide — as well as users of other Chromium-based browsers, like Microsoft Edge — to expect an increasing number of ‘zero-day’ attacks. Google has also explained why and what you can do about it to stay safe.
Writing in a new blog post, Adrian Taylor from the Google Chrome Security Team explained that zero-day attacks (hacks which make it into “the wild” before Google can issue a fix) are rising dramatically.
“You may have noticed that phrases like ‘exploit for CVE-1234-567 exists in the wild’ have been appearing more often recently,” Taylor explains. “While the increase may initially seem concerning, it’s important to understand the reason behind this trend.”
“If it’s because there are many more exploits in the wild, it could point to a worrying trend,” says Taylor. “On the other hand, if we’re simply gaining more visibility into exploitation by attackers, it’s actually a good thing! It’s good because it means we can respond by providing bug fixes to our users faster, and we can learn more about how real attackers operate. So, which is it? It’s likely a little of both.”
Taylor explains that hackers increasingly need multiple attacks to break through Chrome’s defenses due to sandboxing. This is a security security mechanism for separating running programs, so successful attacks cannot spread to more vulnerable parts of the browser.
That said, Taylor does admit the deprecation of Adobe Flash and the dramatic rise in the popularity of Chrome and Chromium-based browsers, are also key factors. In short: they have a much bigger target on their back.
There’s also the question of complexity with Taylor noting that “there’s simply the fact that software has bugs [and] Browsers increasingly mirror the complexity of operating systems — providing access to your peripherals, filesystem, 3D rendering, GPUs — and more complexity means more bugs.”
For its part, Chrome is stepping up its release cycles to try and cut the “patch gap” between zero-day hacks and their fixes becoming available. Taylor notes it has already dropped from 35 days in Chrome 76 to an average of 18 days today with further plans to reduce this in the works.
But much of Google’s good work in the face of these growing attacks still relies on the user, and here Taylor issues a warning. Chrome cannot protect itself automatically. Even after installing an update, Chrome and Chromium-based browsers must be restarted by users before they are protected.
