Chromium Blog: February 2012

More secure extensions, by default

Wednesday, February 29, 2012

with security in mindContent-Security-Policyopt into these featuresmanifest_versionscript-src 'self'; object-src 'self'

Extensions can no longer use inline scripts, such as <script> ... </script>. Instead, extensions must use out-of-line scripts loaded from within their package, such as <script src="foo.js"></script>.

Extensions can no longer use eval(). Note: If you’re using eval to parse JSON today, we suggest using JSON.parse instead.

Extensions can load plug-ins, such as SWF files, only from within their package or from a whitelist of HTTPS hosts.

recent studyimprove the securityThese defenses are extremely effective: adopting one of the recommended CSPs would prevent 96% (49 out of 51) of the core extension vulnerabilities we found. manifest_versionmanifest_versionmanifest_versiona complete listmore detailsextension documentationmailing list
Posted by Adam Barth, Chrome Security Engineer

Pwnium: rewards for exploits

Monday, February 27, 2012

once againChromium Security Rewards programCanSecWestPosted by Chris Evans and Justin Schuh, Google Chrome Security Team

Tech preview of Chromium with Dart engine now available

Thursday, February 16, 2012

Cross posted to the Google Code BlogDartDart VM into ChromiumChromium + Dart VMtry Dartlet us knowPosted by Anton Muhin, Vijay Menon, and Pavel Podivilov, Software Engineers

Changes in Chrome Web Store categories system

Tuesday, February 14, 2012

launched the Chrome Web Storedeveloper dashboardBusiness ToolsShoppingLifestyledeveloper sitedeveloper forum
Posted by Jia Tam, Software Engineer

New resources for Chrome Developers

Monday, February 13, 2012

Field Guide to Web Applications HTML5Rocks.comGamesBusinessMobileHTML5 technology classesChrome DevelopersPosted by Eric Bidelman & Pete LePage

The Future of JavaScript – take a peek today!

Friday, February 10, 2012

Harmonydev channel

Lexical scoping. Now "let" is the new "var" – traditional "var" declarations are complemented with "let" and "const". Both are properly block-scoped bindings, eliminating a common source of errors and weird behaviour. Function declarations are now officially allowed in local scope as well, and also obey lexical scoping. (Note: Lexical scoping is only available in ES strict mode.)

Collections. Efficient maps and sets will make your life easier. Any value can be used as a key or element, including objects. No surprises, no more need to abuse objects as dictionaries. (Caveat: Iteration over collections is not yet specified.)

Weak maps. A special kind of map for which the garbage collector determines when a key is no longer reachable, so that the key-value pair can be removed from the map automatically. This goes a long way towards avoiding memory leaks in long-lived tables and relieves the developer from worrying about stale entries.

Proxies. A proxy simulates a JavaScript object or function, and can customize just about any aspect of their behaviour that you can imagine. This is a real power feature, that takes reflection to a new level and can be used to implement various advanced abstractions and interfaces.

a lot moreExperimental JavaScript featuresfeedbackPosted by Andreas Rossberg and Michael Starzinger, Software Engineers

GPU accelerating 2D Canvas and enabling 3D content for older GPUs

Thursday, February 9, 2012

Beta releaseCanvaschrome://gpufile a bugrecognizeWebGLSwiftShader--blacklist-accelerated-compositing--blacklist-webglBetaPosted by John Bauman and Brian Salomon, Software and Pixel Engineers

Expanding the Chromium Security Rewards Program

Thursday, February 9, 2012

first announcedwell over $300,000 of rewardsvulnerability reward programa big hit

High-severity Chromium OS security bugs are now in scope. Chromium OS includes much more than just the Chromium browser, so we’re rewarding security bugs across the whole system, as long as they are high severity and present when “developer mode” is switched off. Examples of issues that may generate a reward could include (but are not limited to):

Renderer sandbox escapes via Linux kernel bugs.
Memory corruptions or cross-origin issues inside the Pepper Flash plug-in.
Serious cross-origin or memory corruption issues in default-installed apps, extensions or plug-ins.
Violations of the verified boot path.
Web- or network-reachable vulnerabilities in system libraries, daemons or drivers.

Chromium OS bug trackerChromium bug tracker

We may elect to issue “bonuses” ranging from $500 to $1000 if a bug reporter takes on fixing the bug they have found themselves. For eligibility, this process involves working with the Chromium community to produce a peer reviewed patch. These bonuses are granted on top of the base reward, which typically runs between $500 and $3133.70.

The base reward for a well-reported and significant cross-origin bug (for example a so-called UXSS or “Universal XSS”) is now $2000.

core security principlesPosted by Chris Evans, Google Chrome Security

A deeper look at Chrome for Android

Tuesday, February 7, 2012

we introducedinnovative featuresHTML5 featuresremote debuggingChrome Developer Toolsissue trackerPosted by Arnaud Weber, Engineering Manager, Chrome

Oct	NOV	Dec
	09
2019	2020	2021

Chromium Blog