chrome.security

Chrome Security’s mission is to make it safe to click on links.

We have five focus areas:

Exploit Defense, which maintains the sandbox, secures process architecture, runs memory safety initiatives, and works to protect Chrome from hackers.
Secure Web and Network, which maintains the cryptography used by Chrome, secures Chrome’s encrypted network traffic, and works to ensure the core technology of the web is designed with security in mind.
Counter Abuse, which aims to protect people from phishing, malware, and other scams and malicious content.
Bug Response, which ensures bugs in Chrome are found and patched quickly, via fuzzing and the Vulnerability Rewards Program.

We provide the building blocks so that all of Chrome is built with security at front of mind.

Recent blog posts

Thursday 27 June, 2024

Sustaining Digital Certificate Security — Entrust Certificate Distrust

Chrome Root Program

The Chrome Security Team prioritizes the security and privacy of Chrome's users, and we are unwilling to compromise on these values. The Chrome Root Program Policy states that CA certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion. It also describes many of the factors we consider significant when CA Owners disclose and respond to incidents. When things don't go right, we expect CA Owners to commit to meaningful and demonstrable change resulting in evidenced continuous improvement.

Keep reading

Thursday 20 June, 2024

Staying Safe with Chrome Extensions

Benjamin Ackerman, Anunoy Ghosh and David Warren

Chrome extensions can boost your browsing, empowering you to do anything from customizing the look of sites to providing personalized advice when you’re planning a vacation. But as with any software, extensions can also introduce risk.

Keep reading

Thursday 23 May, 2024

Advancing Our Amazing Bet on Asymmetric Cryptography

David Adrian, Bob Beck, David Benjamin and Devon O'Brien

Google and many other organizations, such as NIST, IETF, and NSA, believe that migrating to post-quantum cryptography is important due to the large risk posed by a cryptographically-relevant quantum computer (CRQC). In August, we posted about how Chrome Security is working to protect users from the risk of future quantum computers by leveraging a new form of hybrid post-quantum cryptographic key exchange, Kyber (ML-KEM). We’re happy to announce that we have enabled the latest Kyber draft specification by default for TLS 1.3 and QUIC on all desktop Chrome platforms as of Chrome 124.2 This rollout revealed a number of previously-existing bugs in several TLS middlebox products. To assist with the deployment of fixes, Chrome is offering a temporary enterprise policy to opt-out.

Keep reading

Even more posts!!11!1!oneeleven

Tuesday 30 April, 2024

Detecting browser data theft using Windows Event Logs

Will Harris

Chromium’s sandboxed process model defends well from malicious web content, but there are limits to how well the application can protect itself from malware already on the computer. Cookies and other credentials remain a high value target for attackers, and we are trying to tackle this ongoing threat in multiple ways, including working on web standards like DBSC that will help disrupt the cookie theft industry since exfiltrating these cookies will no longer have any value.

Keep reading

Thursday 4 April, 2024

The V8 Sandbox

Samuel Groß

After almost three years since the initial design document and hundreds of CLs in the meantime, the V8 Sandbox — a lightweight, in-process sandbox for V8 — has now progressed to the point where it is no longer considered an experimental security feature. Starting today, the V8 Sandbox is included in Chrome’s Vulnerability Reward Program (VRP).

Keep reading

Tuesday 2 April, 2024

Fighting cookie theft using device bound sessions

Kristian Monsen, Chrome Counter Abuse

Cookies – small files created by sites you visit – are fundamental to the modern web. They make your online experience easier by saving browsing information, so that sites can do things like keep you signed in and remember your site preferences. Due to their powerful utility, cookies are also a lucrative target for attackers.

Keep reading

Thursday 14 March, 2024

Real-time, privacy-preserving URL protection

Jasika Bawa, Xinghui Lu, Google Chrome Security; Jonathan Li, Alex Wozniak, Google Safe Browsing

For more than 15 years, Google Safe Browsing has been protecting users from phishing, malware, unwanted software and more, by identifying and warning users about potentially abusive sites on more than 5 billion devices around the world. As attackers grow more sophisticated, we’ve seen the need for protections that can adapt as quickly as the threats they defend against. That’s why we’re excited to announce a new version of Safe Browsing that will provide real-time, privacy-preserving URL protection for people using the Standard protection mode of Safe Browsing in Chrome.

Keep reading

Tuesday 13 February, 2024

Optimizing Safe Browsing checks in Chrome

Jasika Bawa, Chrome Security & Jonathan Li, Google Safe Browsing

Balancing security and usability is always top of mind for us as we strive to stay on top of the constantly evolving threat landscape while building products that are delightful to use. To that end, we’d like to announce a few recent changes to how Chrome works with Google Safe Browsing to keep you safe online while optimizing for smooth and uninterrupted web browsing.

Keep reading

Friday 3 November, 2023

Qualified certificates with qualified risks

Improving the interoperability of web services is an important and worthy goal. We believe that it should be easier for people to maintain and control their digital identities. And we appreciate that policymakers working on European Union digital certificate legislation, known as eIDAS, are working toward this goal. However, a specific part of the legislation, Article 45, hinders browsers’ ability to enforce certain security requirements on certificates, potentially holding back advances in web security for decades. We and many past and present leaders in the international web community have significant concerns about Article 45’s impact on security.

Keep reading

Wednesday 11 October, 2023

Unlocking the power of TLS certificate automation for a safer and more reliable Internet

Chrome Root Program

TL;DR: Automated certificate issuance and management strengthens the underlying security assurances provided by Transport Layer Security (TLS) by increasing agility and resilience. This post describes the benefits of automation and upcoming changes to the Chrome Root Program policy that represent Chrome Security’s ongoing commitment to improving web security.

Keep reading

Wednesday 16 August, 2023

Towards HTTPS by default

Joe DeBlasio

For the past several years, more than 90% of Chrome users’ navigations have been to HTTPS sites, across all major platforms. Thankfully, that means that most traffic is encrypted and authenticated, and thus safe from network attackers. However, a stubborn 5-10% of traffic has remained on HTTP, allowing attackers to eavesdrop on or change that data. Chrome shows a warning in the address bar when a connection to a site is not secure, but we believe this is insufficient: not only do many people not notice that warning, but by the time someone notices the warning, the damage may already have been done.

Keep reading