Chrome 67 Site Isolation stops Spectre bug exploits but hogs more memory

New Site Isolation feature will use about 10-13% of memory to cut down side-channel attacks

Google has added a Site Isolation feature to Chrome 67 to protect against Spectre vulnerabilities and similar side-channel attacks, but the fix eats up to 13% more memory.

Site Isolation is a large change to Chrome's architecture that limits each renderer process to documents from a single site. This allows Chrome to rely on the operating system to prevent attacks between processes.

It splits the rendering process into separate tasks using out-of-process iframes, which makes it difficult for Spectre side-channel attacks.

"In Chrome 67, Site Isolation has been enabled for 99% of users on Windows, Mac, Linux, and Chrome OS. Given the large scope of this change, we are keeping a 1% holdback, for now, to monitor and improve performance," Google Chrome team member Charlie Reis explained.

"This means that even if a Spectre attack were to occur in a malicious web page, data from other websites would generally not be loaded into the same process, and so there would be much fewer data available to the attacker. This significantly reduces the threat posed by Spectre."

However, Site Isolation does cause Chrome to create more renderer processes, which comes with "performance tradeoffs" with about 10-13% total memory overhead in real workloads due to a large number of processes.

Spectre, along with Meltdown become publicly known in January and an additional variant of Spectre was disclosed in May. These attacks used the speculative execution features of most CPUs to access parts of memory that should be off-limits to a piece of code and then use timing attacks to discover the values stored in that memory.

"We're now investigating how to extend Site Isolation coverage to Chrome for Android, where there are additional known issues," added Reis.

"Experimental enterprise policies for enabling Site Isolation will be available in Chrome 68 for Android, and it can be enabled manually on Android using chrome://flags/#enable-site-per-process."

Picture: Shutterstock

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Best ransomware removal tools
ransomware

Best ransomware removal tools

22 Jan 2021
Hackers publish over 4,000 files stolen from SEPA in ransomware attack
Security

Hackers publish over 4,000 files stolen from SEPA in ransomware attack

22 Jan 2021
Weekly threat roundup: SAP, Windows 10, Chrome
vulnerability

Weekly threat roundup: SAP, Windows 10, Chrome

21 Jan 2021
Biden nominees highlight tough cyber security challenges
cyber security

Biden nominees highlight tough cyber security challenges

20 Jan 2021

Most Popular

School laptops sent by government arrive loaded with malware
malware

School laptops sent by government arrive loaded with malware

21 Jan 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
What is the Raspberry Pi Pico?
Hardware

What is the Raspberry Pi Pico?

21 Jan 2021