The Story
After Google released the Chrome Frame plugin for Internet Explorer, Microsoft released a statement saying that the plugin makes the browser less secure. According to Microsoft, Chrome Frame has “doubled the attack area for malware and malicious scripts” in that it subverts security measures Microsoft developed for Internet Explorer 8.
Now Google has come out and refuted those claims. For example, both IE7 and IE8 have sandboxing features similar to Chrome’s, but they only work in Windows Vista. To get these features at all in Windows XP requires Chrome Frame or a browser with those features.
Google also stated that the best thing for users to do is to install and use a browser that isn’t Internet Explorer.
While we encourage users to use a more modern and standards-compliant browser such as Firefox, Safari, Opera or Chrome rather than a plug-in, for those who don’t, Chrome Frame is designed to provide better performance, strong security features, and more choice … across all versions of Internet Explorer.
What Microsoft Isn’t Saying
Microsoft’s assertion that Chrome Frame doubles the attack area is a bit misleading. In a sense it does, but only in that it provides two browsers for hackers to go after. If you’re running Chrome Frame, you’re vulnerable to exploits for both Chrome and Internet Explorer. This is misleading because IE6 is far more exploitable than Chrome. To say that vulnerability has doubled is to suggest that Chrome is just as vulnerable.
What Google Isn’t Saying
This is a fun bit of analysis to do. Chrome Frame doesn’t make for a browser which is twice as exploitable. And yet Google chose to present new information rather than to call Microsoft’s bluff.
The reason for doing this is because Google simply doesn’t want to say publically that yes, Chrome does have exploits. When Microsoft issued its statement, it used some very clever language which only acknowledges IE’s vulnerabilities in a very passive and ancillary way. But to deny Microsoft’s claim, Google would have to talk about Chrome’s weaknesses. In a lot of ways, that’s not wise.
Despite all of this beating around the bush, at the end of the day, you’re better off running Chrome Frame in IE6 than just running IE6. But as Google says, just install a real browser like Firefox.
