Browsers

Not one to rest on its laurels, the Google Chrome team is hard at work on Chrome 6. The official move to the 6.0 designation in the Chromium developer builds officially started a few days ago. The move to a Chrome 6 branch for Chromium means that the final tweaks and polishes on Chrome 5 are almost complete. Chrome 5 is a big release — not only is it blazingly fast, it’s also going to be the first stable release for Mac and Linux users. ...

With competition in the Web browser field having transitioned from cold to boiling in less than a year’s time, Mozilla suddenly finds itself playing catch-up against not only Apple and Google, but Microsoft as well. In March, the organization realized it needed to completely make over Firefox 4 if it wanted to remain feature competitive against a fast-rising Google Chrome. In a live presentation yesterday, Mozilla Firefox director Mike Beltzner admitted that his group’s March roadmap, which involved an interim release of Firefox 3.7, had too many steps. Now the group has decided to straighten out its path by grafting version 3.7’s main additions onto a point release Firefox 3.6.4, and shifting gears to focus on version 4.0. ...

Almost one year ago, we’ve gotten a glimpse of the next major iteration of Firefox, at least when it comes to its gorgeous new visuals. Now, however, Mozilla’s Mike Beltzner has shared a presentation that reveals quite detailed plans for Firefox 4. HTML5 and CSS support are mentioned, as well as faster operation, a greater focus on security and stability, new developer tools, and a lot of personalization options. Furthermore, from the screenshots embedded in the presentation, we can see that the visuals from one year ago haven’t changed much, although most menu items (the home button, for example) are positioned differently. ...

For the first time, Microsoft’s share of the browser marked has slipped below 60 percent, according to figures from Net Applications, a Aliso Viejo, Calif., web app and metrics firm . Browser market share: Microsoft — 59.95 percent Mozilla’s Firefox — 24.59 percent Google Chrome — 6.73 percent Apple’s Safari — 4.72 percent Opera — 2.30 percent. Story Here.

Apple has been challenging Google on many fronts this week — first with its mobile platform, then with its advertising platform. Earlier today, its developers launched the first volley in the battle’s third front, releasing the first public code for the next WebKit rendering and processing kernel that will likely drive the Safari 5 browser. With Google Chrome using a reworked form of WebKit, the Apple team did something that perhaps any other free and open source developer would be publicly stoned for doing, but which Apple might just have the savvy to get away with: It openly one-upped another developer’s open contribution. ...

An interesting and unknown feature used by sysadmins around the world in some large corporate networks is the use of proxy-auto config (pac) files. This benign feature is accepted by all modern browsers and is described in detail here. It contains a function to redirect your connection to a specific proxy server. Unfortunately this simple and smart proxy technique are being largely used by brazilian malware writers to redirect infected users to malicious hosts serving phishing pages of financial institutions. A .pac script URL is configured in the browser, in the field “Use automatic configuration script”: ...

Chrome’s share of the browser market is growing at a breakneck pace, according to data from Net Applications. Between February and March, Google’s browser rose to capture a full 6.1% share of the market, maintaining its lead over browsers such as Safari and Opera and closing the gap between Firefox, which currently holds a 24.5% share. While most browsers rose a fraction of a percent, Microsoft’s Internet Explorer continued to decline, losing almost a whole percent over the past month alone. ...

Virus Bulletin is reporting that a recent survey it conducted found that about one out of five people are still using the dangerously-out-of-date version six of Microsoft’s Internet Explorer. There are probably a number of reasons for this: — They are using IE6 at work with legacy systems that require IE6 (or IT never got around to updating the company’s browsers.) — They are using IE6 at home and don’t know that IE6 is frighteningly insecure. — They are using IE6 at home and don’t know that there is such a thing as an update to browser software. — They are using IE6 at home and don’t know there is such a thing as computer security. ...

Tom Gallagher, senior security test lead with Microsoft’s Trustworthy Computing group, was extensively quoted in news stories today as he described how his group found 1,800 software flaws in Office 2010 by running millions of “fuzzing” tests. According to ComputerWorld, “Microsoft was able to find such a large number of bugs in Office 2010 by using not only machines in the company’s labs, but also under-utilitized or idle PCs throughout the company. The concept isn’t new: The Search for Extraterrestrial Intelligence (SETI@home) project may have been the first to popularize the practice, and remains the largest, but it’s also been used to crunch numbers in medical research and to find the world’s largest prime number. ...

Mozilla.org has made public a report that says its Firefox browser has 30 percent market share worldwide. Assuming it’s true, that is a six percent increase since a news story last November. The Mozilla Metrics report 1Q2010 says the browser has 39.2 percent penetration in Europe (152.7 million users) and 29 percent in the U.S. (100 million users.) Mozilla claims 350 million users worldwide. Adoption is quickest in Russia (20 percent increase in the first quarter) the report said. ...

In the Pwn2Own hacking contest at the CanSecWest security conference in Vancouver, Canada, security researchers and hackers quickly hacked three of the major browsers to take control of the underline operating systems. — A German hacker who goes by the handle “Nils” used a previously unknown vulnerability in Mozilla’s Firefox to gain control of a 64-bit Windows 7 machine. — Peter Vreugdenhil an independent researcher from the Netherlands, used several vulnerabilities in Internet Explorer to take control of a machine running a patched 64-bit Windows 7 implementation. ...

Mozilla Foundation has released version 3.6.2 of its Firefox browser a week early. The group had said the update would be available March 30. The update fixes a widely reported vulnerability (CVE-2010-1028) that prompted Germany’s CERT to advise Web users to switch to another browser until a fix was made. (My blog post “Germany’s CERT warns against Firefox use” ) Intevydis researcher Evgeny Legerov had found that Wide Open Font Format decoder in Firefox had an integer overflow in its font decompression mechanism. The flaw involved a memory buffer that was too small to handle a downloadable font. Legerov had found that exploiting the vulnerability could crash a victim’s browser making it possible to run arbitrary code on the system. ...

A little more than a week ago Microsoft started delivering a new Browser Choice for Windows to be compliant to the European Union law. There are plenty of web browsers to choose from, and my colleague Sorin Mustaca recommended Firefox. Usually a good choice, but currently users should be cautious about which browser they choose: Opera just released version 10.51 of their web browser. According to the changelog, it fixes a vulnerability which could lead to execution of injected code. Users of opera 10.50 should update as soon as possible. ...

Apple yesterday released a huge Safari update that fixes 16 vulnerabilities – six for Windows versions and ten for Mac OS X and Windows. The update, Safari 4.0.5, makes fixes in Tiger, Leopard, Snow Leopard and Windows versions. This is probably pretty significant. In November, the TheInquirer.net of the UK carried a piece about browser vulnerabilities that rated Firefox and Safari as the ones with the most vulnerabilities: ...

Google Chrome arrived yesterday as a Windows beta with a comic explaining multi-process tabs and a reputation for speed. Another browser is the last thing some people wanted. For web developers and security folks, it is a big signal: the rendering engine wars are back. Mac and Linux versions do not exist yet. This is a Windows-only beta — but the design choices are worth studying regardless of platform. What Is Different Separate processes per tab — one crash does not take down everything Sandboxing ambitions — harder for web content to touch the system V8 JavaScript engine — fast enough to change how web apps feel in the browser Minimal UI — the address bar doubles as search, fitting Google’s habits Incognito mode — private browsing without digging through menus Silent auto-update — patches ship without a user-facing version bump Chrome uses WebKit for rendering — the same engine family as Safari — with Google’s own V8 replacing JavaScriptCore for script execution. ...