Android gets new security sandboxing features

Google brings mobile site isolation to Chrome to protect against ‘Spectre-like’ attacks

Google has brought new security features to web users on Android, with the integration of browser sandboxing capabilities to its Chrome app.

As of Chrome version 77, Android users are now protected by 'Site Isolation'. This sandboxing feature involves isolating each browser tab from the other tabs in the session, and works by ensuring that web pages from different domains are run as separate processes, reducing the risk of side-channel attacks like the Spectre flaw.

This feature has been active on desktop instances of Chrome for some time, and the Android version is somewhat slimmed-down by comparison; in order to reduce performance overheads, Site Isolation is only enabled for password-protected sites, where users may be at risk of having their credentials stolen. This will help lessen the impact of the feature on smartphone speeds, particularly for cheaper devices with less RAM.

On desktop platforms, meanwhile, the existing sandboxing features have also been strengthened. In addition to side-channel attacks, Chrome can now defend against attacks involving a fully-compromised renderer process.

To coincide with this, the company is temporarily expanding its bug bounty programme to offer greater rewards for bugs involving Site Isolation, as well as including cross-site data disclosure attacks that involve compromised renderers.

Sandboxing is a common security measure, and refers to the process of isolating an environment from neighbouring systems in order to prevent the spread of harmful activity. Sandboxed environments are commonly used by researchers to analyse malware activity, as they allow the malware to be studied without risking the security of the rest of the network or operating system.

Featured Resources

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Simplify cluster security at scale

Centralised secrets management across hybrid, multi-cloud environments

Download now

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

2021 state of IT asset management report

The role of IT asset management for maximising technology investments

Download now

Recommended

Sopra Steria confirms it was hit by new Ryuk ransomware variant
Security

Sopra Steria confirms it was hit by new Ryuk ransomware variant

26 Oct 2020
Google fixes zero-day flaw in Chrome and Chrome OS
bugs

Google fixes zero-day flaw in Chrome and Chrome OS

23 Oct 2020
Microsoft spearheads industry-wide charter against AI cyber attacks
Security

Microsoft spearheads industry-wide charter against AI cyber attacks

23 Oct 2020
Weekly threat roundup: Chrome, Citrix and WordPress
Security

Weekly threat roundup: Chrome, Citrix and WordPress

23 Oct 2020

Most Popular

Microsoft CEO warns of video call fatigue
video conferencing

Microsoft CEO warns of video call fatigue

7 Oct 2020
How Liberty navigated a site relaunch during a pandemic
Sponsored

How Liberty navigated a site relaunch during a pandemic

8 Oct 2020
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020