Google adds Flash sandbox to Chrome beta

Computerworld - Two weeks after it debuted a sandbox to isolate Adobe's Flash Player plug-in, Google today pushed the security enhancement to the more reliable beta channel of its Chrome browser.

Chrome users already running the beta build will be automatically updated to the version that includes the sandboxed Flash.

A "sandbox" isolates processes on the computer, preventing or at least hindering malware from escaping an application to wreak havoc on the machine.

That's become increasingly important for Flash, as the popular media player has been aggressively targeted by hackers this year. Adobe has had to patch Flash five times since January, and in several cases was forced to scramble to release emergency fixes as new attacks surfaced.

Chrome's Flash sandbox relies on some elements of the already-in-place technology that the browser uses to protect HTML and JavaScript. But much of the new work was created from scratch in cooperation with Google, an Adobe executive said when the two companies announced the inclusion of the sandbox in Chrome's "dev" channel Dec. 1.

"The biggest challenge was getting the full functionally of Flash from within this new sandbox," said Brad Arkin, Adobe's director of security and privacy, two weeks ago.

Although the sandbox is currently available only in the Windows version of Chrome, Google has promised to add the same functionality to the Mac and Linux editions. Google did not spell out a timetable for those updates, however.

The newest Chrome beta also includes the browser's version of Google Instant, the preview introduced last month to Google's search engine that shows thumbnail images of Web pages in a search result list.

Dubbed Chrome Instant in the browser, the feature loads Web pages as soon as the user starts typing a URL, said Google software engineer Carlos Pizano in a note on the Chrome blog today.

"In addition, if supported by your default search engine, search results appear instantly as you type queries in the omnibox," said Pizano, referring to Chrome's combination address bar and search field. "In-line predictions will also appear to help guide your search."

Chrome Instant is not enabled by default in the newest beta, but must be switched on from the Basics tab of Chrome's options or preferences.

Google maintains three separate "channels" for Chrome, ranging from stable to beta to dev, the latter two less stable and reliable than the previous.

Users can download the Chrome beta or switch from stable or dev to the beta channel by visiting Chrome's Web site.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com.

Read more about Desktop Apps in Computerworld's Desktop Apps Topic Center.