Google sets a deadline to fix a security flaw in Chrome

In August 2018, Google Chrome was the web browser with 67.66% of the global desktop market share. To put that in context, Mozilla Firefox came second with just 10.96%, followed by Internet Explorer (6.97%), Safari (5.13%) and Microsoft Edge (4.24%). The latest version, Chrome 70, will be released this month, and all eyes seem to be on Google to see what it will do about the security problems that have been affecting extensions.

Over the last decade, extensions have shaped the way each of us uses the internet. With more than 180,000 currently available in the Chrome Web Store, and almost half of the browser's users running at least one, security really has to be taken seriously. All this is to say that attacks have indeed managed to compromise extensions. We mean, for example, extensions that used the resources of the computers they were installed on to mine cryptocurrencies, or developer accounts hijacked by hackers and used to persuade users to update extensions that in fact installed malicious code on their computers.

Another issue that had not gone down well was the lack of transparency in the code. That changed, with immediate effect, when Chrome extensions product manager James Wagner said in a post on the Chromium blog that they would no longer accept obfuscated code, and that "this includes code within the package as well as any external code or resource fetched from the web".

The new policy took effect immediately for all new submissions, and developers of existing extensions with obfuscated code have until 1 January next year to make it clean. If they do not comply with the new rules, their product will be removed from the Web Store for good.

Why is obfuscated code a problem?

According to Wagner, more than 70% of all malicious extensions and policy violations that were blocked contained obfuscated code. Google says this lack of transparency makes the whole review process more complex and slower than it needs to be, and has a big impact on performance for users, as code runs more slowly and uses more memory.

While developers will argue that they write code this way to protect their intellectual property, Wagner counters that, as long as JavaScript keeps running locally, this is not enough to protect that property from someone determined to tamper with the code.

As a compromise, the world's most used search engine will keep allowing what is known as code "minification", a programming technique that, in short, removes all unnecessary characters without removing any functionality. This not only reduces the resources used but can also make code run faster, while having little impact on the policing and security review process.

The "minification" techniques Google will allow include removing white space, comments and code blocks, as well as shortening variable and function names.

The transparency that comes with Chrome 70 also extends to users, who will have more control over whether extensions can read or change data. Today, it is very common to accept the permission an extension asks for when installing it, but users have no control over what they can restrict when it comes to websites.

So another new feature in this version of the browser is that users can turn on restrictions, such as only letting extensions access websites they have authorised, and options to require a mouse click before an extension gets access to any page.

Other changes announced will also affect extension developers: there will be additional acceptance agreements, and all extensions that use remotely hosted code will be closely scrutinised, with ongoing monitoring even after they have been reviewed and approved.

Finally, Google also announced that, from next year, two-factor verification will be mandatory for all developers. This has been encouraged for years, but it had never been required.