Chrome 67 Site Isolation stops Spectre bug exploits but hogs more memory

New Site Isolation feature will use about 10-13% of memory to cut down side-channel attacks

Google has added a Site Isolation feature to Chrome 67 to protect against Spectre vulnerabilities and similar side-channel attacks, but the fix eats up to 13% more memory.

Site Isolation is a large change to Chrome's architecture that limits each renderer process to documents from a single site. This allows Chrome to rely on the operating system to prevent attacks between processes.

Advertisement - Article continues below

It splits the rendering process into separate tasks using out-of-process iframes, which makes it difficult for Spectre side-channel attacks.

"In Chrome 67, Site Isolation has been enabled for 99% of users on Windows, Mac, Linux, and Chrome OS. Given the large scope of this change, we are keeping a 1% holdback, for now, to monitor and improve performance," Google Chrome team member Charlie Reis explained.

"This means that even if a Spectre attack were to occur in a malicious web page, data from other websites would generally not be loaded into the same process, and so there would be much fewer data available to the attacker. This significantly reduces the threat posed by Spectre."

However, Site Isolation does cause Chrome to create more renderer processes, which comes with "performance tradeoffs" with about 10-13% total memory overhead in real workloads due to a large number of processes.

Spectre, along with Meltdown become publicly known in January and an additional variant of Spectre was disclosed in May. These attacks used the speculative execution features of most CPUs to access parts of memory that should be off-limits to a piece of code and then use timing attacks to discover the values stored in that memory.

Advertisement
Advertisement - Article continues below

"We're now investigating how to extend Site Isolation coverage to Chrome for Android, where there are additional known issues," added Reis.

"Experimental enterprise policies for enabling Site Isolation will be available in Chrome 68 for Android, and it can be enabled manually on Android using chrome://flags/#enable-site-per-process."

Picture: Shutterstock

Featured Resources

Top 5 challenges of migrating applications to the cloud

Explore how VMware Cloud on AWS helps to address common cloud migration challenges

Download now

3 reasons why now is the time to rethink your network

Changing requirements call for new solutions

Download now

All-flash buyer’s guide

Tips for evaluating Solid-State Arrays

Download now

Enabling enterprise machine and deep learning with intelligent storage

The power of AI can only be realised through efficient and performant delivery of data

Download now
Advertisement

Recommended

Visit/security/355013/10-quick-tips-to-identifying-phishing-emails
Security

10 quick tips to identifying phishing emails

16 Mar 2020
Visit/business-strategy/mergers-and-acquisitions/354941/panda-security-to-be-acquired-by-watchguard
mergers and acquisitions

Panda Security to be acquired by WatchGuard

9 Mar 2020
Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/software/video-conferencing/355138/zoom-beaming-ios-user-data-to-facebook-for-targeted-ads
video conferencing

Zoom beams iOS user data to Facebook for targeted ads

27 Mar 2020
Visit/infrastructure/server-storage/355118/hpe-warns-of-critical-bug-that-destroys-ssds-after-40000-hours
Server & storage

HPE warns of 'critical' bug that destroys SSDs after 40,000 hours

26 Mar 2020
Visit/software/355113/companies-offering-free-software-to-fight-covid-19
Software

These are the companies offering free software during the coronavirus crisis

25 Mar 2020
Visit/cloud/355098/ibm-dedicates-supercomputing-power-to-coronavirus-researchers
high-performance computing (HPC)

IBM dedicates supercomputing power to coronavirus research

24 Mar 2020