Microsoft has gained an unexpected ally in its fight against the Google Chrome add-on for Internet Explorer --- Mozilla, the maker of Firefox. Mozilla Vice President of Engineering Mike Shaver says in his blog that the add-on can ultimately harm security, disable browser features, and is a wrong-headed move by Google.
Google's Chrome Frame add-on was designed to allow IE work with HTML 5. It also speeds up IE by letting it use Chrome's WebKit rendering engine and high-performance JavaScript engine. Computerworld reports that it can speed up IE by as much as ten times.
As I've written in my blog, though, Microsoft says that the add-on also is a serious security threat, claiming, "Given the security issues with plugins in general and Google Chrome in particular, Google Chrome Frame running as a plugin has doubled the attach area for malware and malicious scripts."
Mozilla's Shaver offers a different set of arguments against the add-on his blog. He, too, believes that the add-on's use could harm security, but for different reasons than Microsoft's. And he points out that it could disable some of IE's features:
Running Chrome Frame within IE makes many of the browser applicationÂ’s features non-functional, or less effective. These include private browsing mode or their other security controls, features like accelerators or add-ons that operate on the content area, or even accessibility support.
Later on, he drives home the point about security:
As a side-effect [of using Chrome Frame], the user's understanding of the web's security model and the behaviour of their browser is seriously hindered by delegating the choice of software to the developers of individual sites they visit. It is a problem that we have seen repeatedly with other stack-plugins like Flash, Silverlight and Java, and not one that I think we need to see replayed again under the banner of HTML5.
Shaver says that if Google want people to have Chrome's ability to work with HTML 5, and its speed, then Google should convince developers to get people to download Chrome --- not to get people to use the Chrome Frame add-on.