Security: Firefox indirectly attacked by Google

An Accuvant Labs study has compared to Google Chrome to Internet Explorer and Firefox, looking at which is the most secure web browser. The study was financed by Google.

Microsoft has often used NSS Labs to provide independent studies that they pay for, with the latest being related to Internet Explorer. The findings from this study revealed that Microsoft’s browser offered the greatest protection against malware and social engineering. The research group did point out though that unlike previous studies, their latest NSS Labs report was not paid for by Microsoft.

Google has also now called for an independent study… paid for by themselves to demonstrate that Google Chrome is superior to the competition (Internet Explorer and Firefox) in terms of security. The outcome of this report wasn’t great for Mozilla’s browser.

“Independent” studies which are paid for by major companies always leave some questions about the findings. Accuvant Labs is the author of this study, with the group trying to make it as transparent as possible by making the tools used available for others to test the browsers.

Accuvant Labs is a respectable player in computer security with researchers including Charlie Miller (one of the authors) working for them. For the study, Accuvant Labs put forward that security vulnerabilities are always found, with their tests therefore being to judge which is the best at protecting a system from a hacker who has already gained access to a machine.

According to Accuvant Labs, Google Chrome is slightly better than Internet Explorer, while Firefox is a fair way back. The picture at the start of this article provides examples of anti-exploitation technologies used by the three browsers.

Accuvant Labs indicates that "Internet Explorer and Chrome are close, but the Chrome architecture for the security of plug-in’s and sandboxing are more in depth and complete. Consequently, we deem Google Chrome to be more secure against attacks".

For more information and details, you will have to go through the study available online (PDF). The table to the left provides a summery, among which we see that the main differences are in sandboxing. And since such protection is not available in Firefox...

The effectiveness of this protection which allows you to limit the effects of an attack on the system is barley any different between Google Chrome and Internet Explorer. The differences are in plug-in security (attacks via plug-in’s with malicious commands) JIT Hardening (performing attacks by compiling JavaScript code in an unpredictable manner for attackers).

It should be noted that the tests were performed on Windows 7 (32 bit) with Google Chrome 12 and 13, Internet Explorer 9 and Firefox 5. The study took place in July 2011.

It has to be wondered whether the current relationship between Google and Mozilla is as cordial as before concerning the competition between Google Chrome and Firefox. How will Accuvant Labs report be interpreted by Mozilla?