Google patches Chrome, beefs up malicious file blocking tech

Computerworld - Google last week patched Chrome 16 and improved the download warnings in the impending Chrome 17.

Last Thursday, Google updated Chrome 16 with a security update that quashed three bugs, all rated "high," the company's second-most-dire threat rating.

Two of the bugs warranted bounties of $1,000 each, including one to a developer who works for rival Mozilla, maker of Firefox. Google, like Mozilla, pays outside investigators for bugs they report: Last year, Google wrote checks totaling $180,000 to bug hunters.

Also last week, Google released the first beta of the next edition in its line, Chrome 17.

According to Google engineer Dominic Hamon, Chrome 17 expands on the anti-malware download warnings that were first added to Chrome's code in April 2011 and appeared in the stable channel of the browser in June 2011's Chrome 12.

"Chrome now includes expanded functionality to analyze executable files -- such as '.exe' and .msi' files -- that you download," said Hamon in a blog post. "If a file you download is known to be bad, or is hosted on a website that hosts a relatively high percentage of malicious downloads, Chrome will warn you that the file appears to be malicious and that you should discard it."

While download warnings have been part of Chrome since version 12, they have been limited to alerts triggered only when a user tries to retrieve a Windows .exe file from a malicious site.

Although the addition of .msi files -- Windows application installers -- was the only enhancement to Chrome's anti-malware warnings that Hamon mentioned, he promised that others would follow. "We're starting small with this initial Beta release, but we'll be ramping up coverage for more and more malicious files in the coming months," he said.

Chrome uses Google's Safe Browsing technology to identify potentially malicious websites, and files downloaded from them. Apple's Safari and Firefox also rely on Safe Browsing for their malware site blocking.

Google is playing catch-up to Microsoft in this area. Since its March 2011 debut, Microsoft's Internet Explorer 9 (IE9) has used a feature called Application Reputation, or App Rep, to identify a file's contents and its digital certificate to determine whether it's a known application with an established reputation. If App Rep's algorithm ranks the file as unknown, IE9 throws up a warning when users try to run or save the file.

If Google keeps to its usual rapid-release schedule that produces a new version about every six weeks, Chrome 17 will likely ship in final form around Jan. 25.

Chrome 17's beta can be downloaded from Google's website.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com.

Read more about Desktop Apps in Computerworld's Desktop Apps Topic Center.