Google: Chrome now protects you against Spectrum password theft attacks

According to Google, a new security feature in Chrome should make it more difficult for malicious Web sites to use a Spectrum-type attack to steal data or pbadwords from others sites in the form of tabs in the same browser. security feature called Site Isolation on Windows, Mac, Linux, and Chrome OS in Chrome 67, the latest version of its browser.

"This means that even if a Spectrum attack were to occur on a malicious Web page, would not usually be loaded into the same process, and so there would be far less data available to the attacker," he said. the Google software engineer, Charlie Reis.

"This greatly reduces the threat posed by Specter."

the attacks, made public in January, actually allow a malicious code to read any memory in the space of. addressing a process.

This flaw is more important for browsers because they use JavaScript code from multiple websites. Uld allow a website to use such an attack to steal information from other sites.

Google said that the site's isolation is a big change to the architecture of Chrome, limiting each rendering process to documents from a single site. This means that all navigations to cross-site documents cause a change of tab.

"Site isolation is a significant change in Chrome's behavior, but should not usually result in any visible changes for most users or web developers." A few known issues.) It simply offers more protection between web sites behind the scenes, "says Reis.

However, because Site Isolation makes Chrome create more rendering process, it means there's an impact on performance. large number of processes, 13% of total memory is needed due to the larger number of processes.

Google said that site isolation has been enabled for 99% of users on Windows, Mac, Linux and Chrome OS Spectrum and Meltdown: insecurity at the heart of modern processor design

Chrome 67 is out: the connections without pbadword are getting closer, as well as the bug fixes, better support AR -VR.

19659002] Google: Chrome is to get away from the pinning of the public key, and here's why