Google Chrome: the most vulnerable application?

The Google Chrome web browser has come out as the winner in the Bit9 annual applications ranking of the most dangerous applications for enterprise, with it leading due to the large number of security vulnerabilities.

Security Company Bit9 is mostly known for their white list technology which allows an administrator to control authorised software installed across a computer network. For the fourth consecutive year, Bit9 has published their Dirty Dozen ranking of the twelve applications which represent the greatest risk to enterprise.

The applications in question are considered popular with end users, and are not applications only destined for enterprise. The essential criteria used for the ranking is the number of serious vulnerabilities detected between January and the 21st of October 2010. To collect such information, Bit9 has used NIST’s database (National Institute of Standards and Technology) and the United States Department of Commerce.

With a total of 76 serious vulnerabilities reported, Google Chrome has come out as leader in Bit9’s 2010 rankings. Another browser came in second, with Apple’s Safari reporting 60 vulnerabilities. The top three is rounded out by Microsoft Office (57 vulnerabilities).

The complete ranking is as follows:

• Google Chrome ( 76 vulnérabilities )
• Apple Safari ( 60 )
• Microsoft Office ( 57 )
• Adobe Reader and Acrobat ( 54 )
• Mozilla Firefox ( 51 )
• Sun Java Development Kit ( 36 )
• Adobe Shockwave Player ( 35 )
• Microsoft Internet Explorer ( 32 )
• RealNetworks RealPlayer ( 14 )
• Apple WebKit ( 9 )
• Adobe Flash Player ( 8 )
• Apple QuickTime and Opera ( 6 )

Bit9 has particularly noted that Apple applications have progressed up their rankings. Like with numerous security companies, Bit9 has hit back at the popularity of Apple products which are now being more widely used as attack targets due to their widespread deployment.

Technical manager at Bit9, Harry Sverdlove has attacked the "myth" surrounding Apple, declaring that "Apple is just as vulnerable, if not more so than Microsoft Windows". He does come through rather calmly against Google Chrome due to its relative youth, stating that its first place "doesn’t mean that it is an at risk browser".

Firefox has previously taken first place in the Dirty Dozen rankings. Mozilla reacted by disputing the simple counting of vulnerabilities as a relevant method. Mozilla also highlighted their transparency in the publication of faults (which is the same for Google Chrome), is penalising to the association, while other editors hide behind their silence.

According to Bit9, such a ranking is used to keep enterprises vigilant. For the company, even though editors provide corrective patches for their identified faults, it is often the end user who is responsible for applying the patches. Of course, Bit9 also used the occasion to promote their own solutions.