Chrome's method of protecting against Spectre uses more RAM

Ceria Alfonso
Julio 13, 2018

Enterprise users may use policies to enable Site Isolation starting in Chrome 68 for Android, and there is also a manual option to turn the feature on right now. It's good news for security but as we've seen with other fixes, it'll cost you in terms of system resources. The trade-off, however, is that Google Chrome will consume 10 percent to 13 percent of additional RAM. Some of the performance hit can be offset by smaller and shorter-lived renderer processes.

While the problem is bigger than just the browser, Google noted in a blog post this week that the Spectre vulnerabilities are especially concerning for Chrome and other browsers. Google is leaving it off for the other 1 percent so engineers can monitor and improve performance.

The company revealed today that it has enabled Site Isolation in 99% of all Chrome installations for the desktop as of Chrome 67.

The mitigation is an impressive engineering feat that's created to lessen the damage of attacks that exploit a new class of vulnerability that came to light in January.

Following the disclosure of the Spectre and Meltdown vulnerabilities, browser vendors have been in the hard position of balancing mitigations for these hardware-level vulnerabilities with preserving browser performance.

Assuming you have a ton of tabs open already, you can open up Google Chrome's Task Manager (Under Menu - More Tools) and look for processes that say "Subframe:" and show a URL that is clearly not something you're browsing directly-for instance doubleclick.net or 2mdn.net, which are iframes for ads.

More news: El misionero Pitana a la final del Mundial

Google explains that the goal of the fix is to prevent an attacker from getting more data from the user. Thus, https://google.co.uk would be a site, and subdomains like https://maps.google.co.uk would stay in the same process. Site Isolation makes Spectre attacks less risky by using a separate renderer for each domain. Threads used to render the page in one process can not interfere with nor snoop on, via speculative execution or crafty JavaScript, other sites, prevent malicious pages from lifting passwords and other secrets.

With Site Isolation, a single page may now be split across multiple renderer processes, preventing bad sites from snooping on legit ones. "This would allow a successful Spectre attack to read data (e.g., cookies, passwords, etc.) belonging to other frames or pop-ups in its process", explained Reis.

Enforcing Site Isolation comes with a drawback, though. According to Google, this "also [makes] it possible to block the process from receiving certain types of sensitive data from other sites".

"Splitting a single page across multiple processes is a major change to how Chrome works, and the Chrome Security team has been pursuing this for several years, independently of Spectre".

While that's great, the fact that Chrome now uses even more RAM isn't great news to owners of older computers, which may not have enough RAM to spare. This would normally fail to render and not expose the data to the page, but that data would still end up inside the renderer process where a Spectre attack might access it.

Otros informes por

Discuta este artículo

SIGUE NUESTRO PERIÓDICO